Linux File System Explained: /etc, /var, /usr, /home, /tmp, and More

Open a Linux terminal and type ls /. You will see directories such as /etc, /home, /usr, /var, and /tmp. They are not arbitrary folders. Together, they form a structured directory tree that tells Linux where different kinds of files belong.

Learning this structure is one of the most useful steps in Linux administration. Once you know what the major directories represent, configuration files become easier to find, logs make more sense, software locations become less mysterious, and troubleshooting becomes much faster.

🌳 Linux Uses One Directory Tree

Linux presents files through a hierarchical tree. At the very top is a directory represented by a single slash:

/

This is the root directory. Every path in the system ultimately begins from this point.

A simplified Linux directory tree might look like this:

/
├── bin
├── boot
├── dev
├── etc
├── home
│   ├── alice
│   └── bob
├── proc
├── root
├── run
├── sys
├── tmp
├── usr
│   ├── bin
│   ├── lib
│   └── share
└── var
    ├── log
    └── cache

Real systems contain more directories and many more files, but the underlying idea is the same: everything is reachable through one hierarchy.

📍 Absolute Paths Start at /

A path tells Linux where a file or directory is located.

An absolute path begins at the root directory. For example:

/var/log

You can read this path from left to right:

Start at the root directory, enter var, then enter log.

A relative path is interpreted from your current working directory instead. This distinction becomes important when navigating the shell, but the directory hierarchy itself always traces back to /.

🗂️ The Main Linux Directories

You do not need to memorize every directory immediately. Start with the ones you will encounter repeatedly while administering a server.

⚙️ /etc — System Configuration

Many programs keep system-wide configuration files or configuration directories under /etc. The exact contents depend on the distribution and installed software.

For example, you may encounter configuration associated with networking, SSH, users, package management, system services, and other components here.

You can inspect the directory safely with:

ls /etc

The key mental association is:

/etc → configuration.

📊 /var — Data That Changes

A particularly important subdirectory for administrators is:

/var/log

Traditionally, many system and application log files are stored there. On systems using systemd’s journal, some logging information may instead or additionally be maintained by systemd-journald, so you should not assume that every useful log must exist as a plain text file in /var/log.

Other areas under /var may contain caches, spool data, application state, and other files whose contents change over time.

The useful association is:

/var → changing system and application data.

👤 /home — Regular Users’ Files

For a user named alice, that might be:

/home/alice

A home directory can contain the user’s documents, scripts, downloads, SSH-related files, and hidden configuration files.

Files whose names begin with a dot are hidden from a normal ls listing. To include them, use:

ls -la /home/alice

Use a username that actually exists on your system rather than assuming alice is present.

🔐 /root Is Not the Root Directory

This naming causes a great deal of beginner confusion.

/ and /root therefore describe completely different locations.

If you remember only one distinction from this section, remember:

/ is the root directory; /root is a user’s home directory.

🧊 /tmp — Temporary Files

Do not treat /tmp as permanent storage. Temporary-file cleanup behavior can vary between systems, and files there may be removed according to operating-system policy or during system maintenance.

That makes /tmp useful for disposable working data, not for anything you cannot afford to lose.

🛠️ /usr — Programs, Libraries, and Shared Data

Common subdirectories include:

• /usr/bin — many executable commands.
• /usr/lib — libraries and related software data, with details varying by system architecture and distribution.
• /usr/share — architecture-independent shared data.
• /usr/local — a hierarchy traditionally available for software and data installed locally by the administrator.

One historical source of confusion is the relationship between directories such as /bin and /usr/bin. On many modern distributions, the traditional top-level locations are merged with their equivalents under /usr, often through symbolic links. You should therefore inspect the actual system rather than assuming every Linux distribution uses an identical physical layout.

🚀 /boot — Files Used to Boot the System

/boot contains files associated with booting Linux. Depending on the system, this can include Linux kernel images, initial RAM filesystem images, and bootloader-related files.

Unlike directories such as /home, /boot is not an ordinary workspace for user data.

💾 /dev — Devices Appear as Files

This is connected to a fundamental Unix idea: many resources can be accessed through file-like interfaces.

For example, storage devices and terminals can have entries beneath /dev. These entries are not ordinary documents containing the device’s data. They are interfaces exposed through the filesystem namespace.

🔍 /proc — A Window Into Processes and the Kernel

/proc looks like a normal directory, but it is normally backed by a virtual filesystem rather than ordinary files stored on disk.

It exposes information about the running kernel and processes.

For example, directories with numeric names under /proc correspond to process IDs:

ls /proc

If a process has PID 1234, a directory named /proc/1234 can expose information related to that process while it exists.

This creates an important conceptual bridge:

The exact entries available depend on the kernel and process, but the important point is that /proc provides a filesystem interface to live system information.

⚙️ /sys — Devices and Kernel Objects

/sys is another virtual filesystem used to expose information about devices, drivers, and other kernel objects.

As a beginner, you do not need to understand every object beneath it. Remember the conceptual distinction:

• /dev provides device nodes used to interact with devices.
• /proc exposes process and other kernel information.
• /sys exposes a structured view of devices and kernel objects.

You will encounter these directories frequently when learning hardware detection, storage, networking, containers, and lower-level Linux administration.

⏱️ /run — Runtime State

/run stores volatile information about the system since it booted. Software can use it for runtime state such as PID files, sockets, and other data needed while the system is operating.

The central idea is that /run represents current runtime state, not permanent user data.

Its contents are therefore fundamentally different from persistent configuration in /etc or user files under /home.

🧠 A Better Way to Remember the Linux File System

Trying to memorize a long list of directory names is inefficient. Instead, associate directories with questions you will ask while administering a server.

🧪 Mini Lab: Explore the Linux Directory Tree

pwd

ls /

ls /etc

ls /var

ls /var/log

ls -la ~

ls /proc/$$

⚠️ Common Linux File System Mistakes

Putting the Linux Directory Structure Together

The most important idea is not that Linux has a directory called /etc or /var. It is that the directory hierarchy separates different kinds of system data according to purpose.

Configuration belongs in different places from changing application data. User files are separated from boot files. Runtime kernel information can appear through virtual filesystems such as /proc and /sys. Storage devices can be mounted into this same hierarchy instead of receiving independent drive letters.

Once that model becomes familiar, unfamiliar Linux servers become easier to explore. You may not know every installed application, but you already know the kinds of places where its configuration, logs, executables, and runtime information are likely to appear.