Bringing Order to Chaos
Because everything starts at /, it could easily become a mess if every Linux distribution organized things differently. Ubuntu might put logs in /logs, Red Hat in /system/logs, Debian in /var/records. Chaos.
To prevent this, the Linux community developed the Filesystem Hierarchy Standard (FHS) — a specification that defines the main directories and their purposes. It ensures that a sysadmin familiar with Ubuntu knows roughly where to find logs or configuration files on a CentOS server, an Arch system, or a Raspberry Pi running Raspbian.
The FHS isn't enforced by the kernel — it's a social contract that distributions choose to follow.
The Essential Neighborhoods
While there are many directories, as an engineer, these are the ones you will visit most often:
| Directory | Purpose | You'll go here when... |
|---|---|---|
/ |
Root — the starting point of everything | Rarely directly; it's just the anchor |
/bin |
Essential user binaries (ls, cp, cat, bash) |
Looking for basic commands |
/sbin |
System binaries for administration (fdisk, iptables, reboot) |
Performing system-level operations |
/etc |
System-wide configuration files | Configuring services, editing settings |
/home |
User home directories (/home/jane, /home/deploy) |
Storing personal files, user-specific configs |
/var |
Variable data — logs, caches, spools | Reading logs (/var/log), debugging |
/tmp |
Temporary files (cleared on reboot) | Storing throwaway data during scripts |
/usr |
User programs and data (read-only after install) | Finding installed applications |
/opt |
Optional/third-party software | Installing software outside the package manager |
/dev |
Device files | Interacting with hardware |
/proc |
Virtual filesystem for process and kernel info | Inspecting running processes, kernel state |
/sys |
Virtual filesystem for kernel/hardware interface | Querying or modifying hardware settings |
/run |
Runtime data for processes since last boot | PID files, sockets, early-boot state |
Deeper Look at Key Directories
/etc (Configuration Central):
The name comes from the original Unix "et cetera" catch-all, but think of it as "Editable Text Configuration." Nearly every service you install puts its configuration here:
/etc/nginx/nginx.conf— Nginx web server config/etc/ssh/sshd_config— SSH daemon settings/etc/passwd— User account information (not passwords — those are in/etc/shadow)/etc/hosts— Local DNS overrides/etc/cron.d/— Scheduled task definitions
/var (The Living Directory):
Unlike /etc (which changes only when you deliberately edit configs), /var changes constantly during normal operation:
/var/log/— System and application logs/var/lib/— Persistent state for services (databases store data here; e.g.,/var/lib/postgresql/)/var/cache/— Application cache files that can be safely deleted/var/spool/— Queues for deferred work (print jobs, mail)/var/run/— On modern systems, this is typically a symlink to/run
/tmp vs /var/tmp:
Both are for temporary files, but /tmp is typically cleared on every reboot (and sometimes more frequently via a systemd timer), while /var/tmp persists across reboots. Use /tmp for truly ephemeral data within a single session; use /var/tmp if a process might need the file after a reboot — for example, a package manager's partially downloaded archive.
/usr — The Secondary Hierarchy:
/usr contains the bulk of installed software and is intended to be read-only after installation. It mirrors the root structure: /usr/bin for user commands, /usr/sbin for admin commands, /usr/lib for libraries, /usr/share for architecture-independent data. On modern systems (Fedora, Ubuntu 20.04+), /bin and /sbin are symlinks into /usr/bin and /usr/sbin — the distinction has been collapsed for simplicity.
A common interview question: "Where would you look first to debug why a service isn't starting?" The answer is almost always /var/log/. Specifically, check /var/log/syslog or /var/log/messages for general system logs, and look for service-specific logs like /var/log/nginx/error.log. On systemd-based systems, also run journalctl -u servicename -n 50 --no-pager to see the last 50 log lines for that unit. Knowing both the FHS path and the systemd journal demonstrates operational depth.
Key Point: Modern systems using systemd often blur some FHS lines — /bin and /usr/bin are frequently symlinked together, for example. But the conceptual separation remains useful: configuration in /etc, variable runtime data in /var, user data in /home. When you're lost on an unfamiliar system, the FHS is your map.