The Filesystem Hierarchy Standard

The Filesystem Hierarchy Standard (FHS) is the agreement that decides what goes in /usr, what goes in /etc, what goes in /var, and what goes in /opt. The agreement is informal — no Linux distribution is FHS-certified — but every distribution follows it closely enough that you can move between them without relearning where things live.

The layout

flowchart TB
  ROOT["/ (root)"]

  ROOT --> BOOT["/boot<br/>kernel, initramfs, bootloader"]
  ROOT --> BIN["/bin<br/>essential user binaries"]
  ROOT --> SBIN["/sbin<br/>essential system binaries"]
  ROOT --> LIB["/lib<br/>shared libraries"]
  ROOT --> ETC["/etc<br/>host configuration"]
  ROOT --> HOME["/home<br/>user home directories"]
  ROOT --> ROOTDIR["/root<br/>root\'s home"]
  ROOT --> OPT["/opt<br/>add-on software"]
  ROOT --> USR["/usr<br/>userland (bin, lib, sbin, share, local)"]
  ROOT --> VAR["/var<br/>variable data (logs, caches, spool)"]
  ROOT --> RUN["/run<br/>runtime data (sockets, PIDs)"]
  ROOT --> PROC["/proc<br/>kernel + process info"]
  ROOT --> SYS["/sys<br/>device + driver info"]
  ROOT --> DEV["/dev<br/>device files"]
  ROOT --> TMP["/tmp<br/>temporary files"]
  ROOT --> SRV["/srv<br/>data served by the system"]
  ROOT --> MNT["/mnt and /media<br/>transient mount points"]

What every directory is for

The short version, with production framing. The FHS reference (linked above) has the long version.

/usr — the bulk of the operating system

/usr is large, mounted early in boot, and should be treated as read-only in production. The interesting subdirectories:

• /usr/bin — user commands. Every binary you can exec lives here.
• /usr/sbin — system commands. The historical distinction (“sbin = system binaries”) has eroded; in practice, /usr/sbin contains commands intended for root and /usr/bin contains commands for everyone.
• /usr/lib — libraries for /usr/bin and /usr/sbin.
• /usr/share — architecture-independent data: man pages, locale files, icons.
• /usr/local — locally-installed software that bypasses the package manager. Sysadmins use /usr/local for tools installed from source or for vendor scripts.
• /usr/include — C headers (developer concern).

$ ls -ld /usr /var /etc /run /tmp

drwxr-xr-x  13 root root  4096 Jul 19 09:18 /usr
drwxr-xr-x  10 root root  4096 Aug  8 22:54 /var
drwxr-xr-x 120 root root  12288 Aug  9 10:01 /etc
drwxr-xr-x  28 root root   780 Aug  9 12:30 /run
drwxrwxrwt  15 root root   480 Aug  9 12:30 /tmp

/var — where disk-full incidents live

/var is where variable data lives. In production, the most common disk-full incidents come from:

• /var/log — log files filling the disk because rotation is broken or undersized.
• /var/cache — package manager caches (apt, dnf) growing unbounded.
• /var/lib — state for installed services: databases, container storage, package database, machine-id.
• /var/tmp — temporary files that are meant to survive reboot, and are aged out after 30 days rather than 10. Do not assume the converse for /tmp: it only vanishes at reboot where the distribution mounts it as tmpfs.
• /var/spool — mail queues, print queues, cron spool.

/etc — the host configuration

/etc is small, text, and authoritative. Every daemon reads its configuration from somewhere under /etc. A few important conventions:

• /etc/passwd, /etc/shadow, /etc/group — identity databases.
• /etc/sudoers, /etc/sudoers.d/ — privilege escalation.
• /etc/ssh/ — OpenSSH server and client configuration.
• /etc/systemd/ — systemd configuration overrides.
• /etc/fstab — filesystems mounted at boot.
• /etc/hosts, /etc/resolv.conf, /etc/nsswitch.conf — name resolution.
• /etc/chrony/chrony.conf or /etc/ntp.conf — time synchronisation.

Locating a binary, its config, and its logs

The three things every sysadmin needs to find for every service:

1. Find the binary: which, command -v, type, or dpkg -L <pkg> / rpm -ql <pkg> to see all files installed by the package
2. Find the configuration: dpkg -L <pkg> or rpm -qc <pkg> lists config files. For ad-hoc discovery, grep -r "Include" /etc/<daemon>/ and look for Include directives
3. Find the logs. journalctl -u SERVICE is the systemd-native path. For traditional syslog, check /var/log/SERVICE and /etc/logrotate.d/SERVICE
4. Find the unit file (systemd). systemctl cat SERVICE shows the active unit file including drop-in overrides

$ dpkg -L openssh-server | grep -E 'bin/|etc/.*ssh'

/usr/sbin/sshd
/etc/ssh/sshd_config
/etc/ssh/ssh_config.d
/etc/init.d/ssh

WhyThisMatters

Knowledge check