The Linux directory structure is a single tree of folders that starts at one root, written as /, where each top-level branch has a specific job. Programs go in one place, their settings in another, and data that changes in a third. The layout looks arbitrary at first, but it follows a deliberate logic.
Picture logging into an unfamiliar server late at night because a website is down. You need the error log and you need to change one setting. If you don't know the layout, you end up guessing at folders or running slow searches across the whole disk. If you do, you can go straight to the right place. This guide walks through each branch, explains why it exists, and shows how they fit together.
- Every file on Linux sits in one tree that begins at the root, /.
- The Filesystem Hierarchy Standard (FHS) keeps that layout similar across distributions.
- Installed software lives in /usr, system configuration in /etc, and changing data such as logs in /var.
- /dev, /proc and /sys aren't ordinary files. They are live views of devices, processes and the kernel.
- Once you know what each directory is for, you know where to look for anything.
- 0:00Intro
- 0:24Lost on an unfamiliar server
- 1:17One tree, one root
- 2:07A shared standard for layouts
- 2:51/bin and /sbin: essential commands
- 3:53/usr: where software lives
- 4:45/etc: the system's settings
- 5:42/var: data that changes
- 6:32/home, /root and /tmp
- 7:19Devices and kernel as files
- 8:19Tracing nginx across the tree
- 9:17Three ways it goes wrong
- 10:07The tree at a glance
- 10:39Know the purpose, find any file
What is the Linux directory structure?
Linux arranges everything as one tree of directories that begins at a single root, written as a forward slash. Every full path starts with that slash, so any file can be traced back to the same starting point. Under the root sit the main branches: /usr for installed programs, /etc for configuration, /var for changing data and /home for user files. Each of these branches out further.
Unlike Windows, Linux has no drive letters, so there is no C: or D:. Even if a machine has several disks, you still see one tree. A second disk or a USB stick is attached, or mounted, at a folder, typically somewhere under /mnt or /media. The hardware can change, but the shape of the tree stays the same.
The branches have the same names on almost every system because of the Filesystem Hierarchy Standard (FHS). It is a published rulebook that defines what each top-level directory should contain and how it should be used. Ubuntu, Fedora and Debian differ in details, but /etc, /usr and /var mean the same thing on each. Package managers and scripts depend on that predictability as much as people do.
- One root (/) for the whole system
- No drive letters: extra disks mount into a folder
- FHS stands for Filesystem Hierarchy Standard
- Skills learned on one distribution carry over to others
What are /bin and /sbin used for?
The /bin and /sbin directories hold the essential commands the system needs to work. These are the basic tools you would need even to repair a broken system. /bin contains everyday commands such as ls, cp and cat that any user can run. The "s" in /sbin stands for system. It holds administrative tools like fdisk, which manages disks, and these are usually run with root privileges.
On many modern distributions, these two directories are no longer separate folders. They are symbolic links pointing into /usr. The terminal output below shows this. which reports that ls lives in /usr/bin and fdisk in /usr/sbin, and ls -ld shows /bin and /sbin as links. The old paths still work, but /usr is where the files actually live.
- /bin: everyday commands for all users
- /sbin: system tools, usually run as root
- Often merged into /usr on modern distros
which ls
which fdisk
ls -ld /bin /sbinWhat is /usr in Linux?
/usr is usually the largest branch on a Linux system. It holds most of the software you install, along with everything that software needs to run. When you install a package, most of its files end up somewhere inside /usr. It splits into several subdirectories: /usr/bin for user programs, /usr/sbin for admin programs, /usr/lib for the libraries they load, /usr/share for documentation and shared data, and /usr/local for your own installs.
The package manager, such as apt or dnf, owns most of /usr. It adds files there and removes them later, so a file you edit by hand can be overwritten on the next update. Software you compile or install manually belongs in /usr/local instead. That keeps your additions separate from the system's, which makes upgrades and cleanup much easier.
- /usr/bin and /usr/sbin: programs
- /usr/lib: libraries
- /usr/share: docs and shared data
- /usr/local: software you build or install yourself
What is stored in /etc?
If programs live in /usr, their settings live in /etc, which stores the configuration for the whole system. This split answers the question many beginners ask: why are a program and its settings in different places? The separation is deliberate. The same nginx binary runs on every server, but each server's /etc describes how it should behave on that particular machine. Configuration is specific to the host, not to the software.
Almost everything in /etc is a plain text file. You can read, compare and edit these files with any editor, and they are easy to back up and track. The examples below show the machine's name in /etc/hostname, the disks mounted at boot in /etc/fstab, and the SSH server's settings in sshd_config. Editing files like sshd_config requires sudo.
Most services read their configuration only when they start. Saving a change to a file in /etc therefore doesn't take effect immediately. You need to restart or reload the service before the new setting applies.
- Plain text, readable with any editor
- Settings for this machine, not the software itself
- Edit, then restart or reload the service
# the machine's name
cat /etc/hostname
# disks to mount at boot
cat /etc/fstab
# SSH server settings
sudo nano /etc/ssh/sshd_configWhat is /var and why does it grow?
Settings in /etc rarely change. Some data, however, changes constantly while the system runs, and that goes into /var, which is short for "variable". As a rule of thumb, a file that is written to all the time almost certainly belongs under /var. Running services write mainly into three places inside it.
/var/log records what happened on the system. /var/cache keeps data that can be reused, such as downloaded packages. /var/spool holds jobs waiting their turn, such as mail or print jobs. Logs keep growing line after line, so /var is the directory most likely to fill up a disk if nobody manages it.
When something fails, /var/log should be your first stop. The explanation is usually already written there, so checking the logs is faster and more reliable than guessing.
- /var/log: system and service logs
- /var/cache: reusable data like downloaded packages
- /var/spool: queued mail and print jobs
/home, /root and /tmp: where personal files go
The directories covered so far hold the system's own files. Three more separate what belongs to people from what belongs to the system. A normal user such as Alice gets her own folder at /home/alice. The root user, the administrator, has /root, which is kept apart from everyone else's files.
Giving each user a separate home folder means one user can't casually change another's work. It also means the system can be reinstalled while the home folders stay untouched. /tmp is scratch space where programs put short-lived files. Its contents may be wiped at reboot, so never keep anything important there. Anything you care about belongs in your home folder.
- /home/username: each user's personal files
- /root: the administrator's home
- /tmp: temporary files that may be cleared at reboot
What are /dev, /proc and /sys?
Three directories don't hold ordinary files at all. /dev, /proc and /sys present devices, processes and kernel information as if they were files. This follows a long-standing Linux idea that almost everything can be treated as a file. Reading one of these files is effectively asking the kernel a question.
In /dev, hardware such as disks and terminals appears as special files, so tools can read and write them with normal file operations. In the example below, /dev/sda is the first disk and /dev/sda1 and /dev/sda2 are its partitions. In /proc, each running process gets a numbered folder, and tools like ps and top read from it. /sys shows what the kernel knows about hardware and drivers, such as whether the network card eth0 is up.
None of this is stored on disk. The contents are generated on demand each time you look, which is why they always reflect the current state of the system.
- /dev: devices such as disks and terminals
- /proc: a live view of running processes
- /sys: kernel and hardware details
ls /dev/sda*
cat /proc/sys/kernel/hostname
cat /sys/class/net/eth0/operstateExample: where nginx keeps its files
Back to the broken website. Say it runs on nginx, a popular web server. Following the directory structure tells you where each part of it lives. The program file is at /usr/sbin/nginx. Its configuration is in /etc/nginx/. Its logs are in /var/log/nginx/. The website's files are often in /var/www/html, a common default.
In a late-night outage, start with the error log in /var/log/nginx. It usually names the exact problem, such as a typo in a configuration file. You then fix that file in /etc/nginx and reload the service. The same pattern works for SSH, cron and databases: the binary in /usr, the settings in /etc, the logs in /var. Once you learn it, you can apply it to most services.
- Binary: /usr/sbin/nginx
- Config: /etc/nginx/
- Logs: /var/log/nginx/
- Site files: /var/www/html
Common mistakes with Linux directories
Knowing the tree also means knowing its traps. Most administrators have made at least one of these mistakes. The first is editing files without a backup. Before changing anything in /etc, copy the file, for example to a name ending in .bak. If the service won't start afterwards, you can restore the original in seconds.
The second mistake is letting /var fill up. Unchecked logs can eat an entire disk, and then services can't write at all. Use log rotation and check free space regularly. The third is misusing /tmp. Saving real work there risks losing it at reboot. Treat /tmp as scratch paper and keep real files in your home folder.
- Copy config files before editing them
- Rotate logs and monitor disk space
- Never store important files in /tmp
Key takeaways
- Linux has one directory tree, starting at the root /, regardless of how many disks are attached.
- The FHS keeps the layout consistent, so what you learn on one distro applies to others.
- Programs live in /usr, their settings in /etc, and their changing data and logs in /var.
- When something breaks, check /var/log first, then fix the configuration in /etc and reload the service.
- /dev, /proc and /sys are generated live by the kernel and are not stored on disk.
- Keep your own files in /home and your own builds in /usr/local.
Frequently asked questions
Why does Linux keep programs in /usr but settings in /etc?
The separation is deliberate. The same program can run on many machines, while each machine's /etc says how it should behave on that host. Keeping them apart also means package updates to /usr don't overwrite your configuration.
Where are log files stored on Linux?
Logs are stored under /var/log, often in a subfolder named after the service, such as /var/log/nginx. This is usually the first place to look when something fails.
What is the difference between /bin and /usr/bin?
Historically, /bin held essential commands and /usr/bin held other installed programs. On many modern distributions, /bin is now just a symbolic link to /usr/bin, so both paths lead to the same files.
Is it safe to delete files in /tmp?
/tmp is meant for short-lived files, and its contents may be wiped at reboot anyway. Programs that are currently running may still be using files there, so it's best to let the system clear it rather than deleting files by hand.
What is the Filesystem Hierarchy Standard?
The Filesystem Hierarchy Standard (FHS) is a published rulebook that defines what each top-level Linux directory should contain. Distributions follow it, which is why /etc, /usr and /var mean the same thing on Ubuntu, Fedora and Debian.
Where should I install software I compiled myself?
Put it in /usr/local. The package manager controls the rest of /usr, and keeping your own software in /usr/local means system updates won't overwrite it.
