The Linux directory structure: what /etc, /var and /usr are for

People coming from Windows look for drive letters, C: and D:, and do not find them. On Linux everything starts from a single root, /, and every disk, USB stick or partition is «hung» somewhere on this tree. The layout of the directories follows a convention, the Filesystem Hierarchy Standard (FHS), broadly respected by almost every distribution. Knowing it means knowing where to look for a configuration file, a log or a program without guessing.

One root, many mount points

When you plug in a USB stick, the system makes it available in a directory, for example /media/anna/USBSTICK. That directory is called a mount point. The same applies to a second internal disk, which might be mounted at /data, or to a network share. For the user it is all one tree: it is the kernel that knows that under /data the files physically live on another device.

The findmnt command, or the simpler df -h, shows what is mounted and where.

The main directories

/etc: where configuration lives

Almost all system configuration sits in /etc, in readable text files. A few examples:

• /etc/hostname holds the machine's name;
• /etc/hosts maps names to IP addresses even before DNS;
• /etc/fstab lists the filesystems to mount at boot;
• /etc/passwd and /etc/group describe users and groups, while the hashed passwords are in /etc/shadow, readable only by the administrator;
• directories such as /etc/ssh/ or /etc/nginx/ gather the configuration of individual services.

Since it is all text, a good habit is to copy a file before editing it, for example sudo cp /etc/fstab /etc/fstab.bak. A mistake in /etc/fstab can prevent booting, and having the previous version at hand makes recovery much shorter.

/usr: installed programs

Although the name suggests «user», /usr holds read-only system software: /usr/bin the executables, /usr/lib the libraries, /usr/share documentation, icons and shared data. On many recent distributions /bin and /sbin are just links to /usr/bin and /usr/sbin, a simplification known as the «usr merge».

Then there is /usr/local, reserved for software the administrator installs by hand, outside the package manager. Keeping the two apart prevents an update from overwriting a self-compiled program and vice versa.

/var: what changes over time

/var holds data that grows and changes while the system runs:

• /var/log contains system and service logs;
• /var/cache holds caches, including downloaded packages;
• /var/lib keeps programs' persistent state, for example the databases of many services;
• /var/spool holds queues of pending jobs, such as print jobs and mail.

When a server runs out of disk space, /var is the first place to check: a log growing without rotation or a cache that is never cleaned are frequent causes.

/home and hidden files

Every user has a folder in /home. Inside, besides Documents and Downloads, there are many hidden files and folders whose names start with a dot: .bashrc for the shell, .config/ for program settings, .local/share/ for their data, .cache/ for caches. When an application misbehaves, renaming its folder in .config and restarting it is often the quickest way to check whether the problem lies in the user's configuration.

Keeping /home on a separate partition lets you reinstall the system without touching personal data.

/dev, /proc and /sys: files that are not files

In /dev every device is represented by a file: /dev/sda is the first SATA or USB disk, /dev/nvme0n1 the first NVMe SSD, /dev/null a bottomless pit where unwanted output can be discarded.

/proc and /sys take no disk space: the kernel generates their content when they are read. cat /proc/cpuinfo describes the processor, cat /proc/meminfo the memory, and every process has a /proc/PID folder with information about its state. Many diagnostic commands, such as ps and free, read from exactly here.

What not to touch

A few prudent rules: do not delete files in /usr, /boot or /var/lib to free space, because they belong to packages and their state; do not edit /etc/shadow by hand; do not write directly to a file in /dev that represents a disk unless you know exactly what you are doing. To free space there are proper tools, such as cleaning the package manager's cache and rotating logs.

In short

• Linux has a single root /; disks and USB sticks are mounted in directories of the tree.
• Configuration lives in /etc, programs in /usr, variable data and logs in /var.
• /usr/local and /opt hold software installed outside the package manager.
• /proc and /sys are generated by the kernel and show the system's state in real time.
• Copy a file in /etc before editing it; do not delete system files to make room.