Learn System Files In Linux & How To Find Them (104.7 LPIC1)
This post is designed to answer the Linux Professional Institute 1 Certification topic 104.7 on how to “Find system files and place files in the correct location”.
When linux has fully booted up and presents us with a desktop environment we can then take a look around the various directories (folders) in the file system.
But do know what the majority of these directories are for?
It may take some time to familiarize yourself with these files, directories and the commands used to find them but all it takes is practice and consistency.
After spending a little time navigating through the file system in the terminal (using “cd” and “cd ..” most likely) you will get comfortable in no time.
There’s hundreds (maybe even thousands) of linux distributions out in the wild, but one thing they all (usually) have in common is the hierarchical file system.
Why?.. because it’s a standard that all distro creators are expected to adhere to.
Let’s take a look!
Contents
FREE Download: Linux Mint Tool Collection!
Install tons of great software from the Linux Mint repository with my personal tool list that I’ve built up over the years. I also keep this list updated from time-to-time.
For more information Click Here
1. The Linux File Hierarchy Standard (FHS)
The FHS is very rarely updated and it’s purpose is to tell us where we should keep certain files in the system.
This is due to the fact that linux has a multitude of distributions such as Ubuntu, Mint, SuSE etc.
This standard helps these distribution creators in keeping files in the same place on each system.
Not all distribution creators strictly adhere to these standards.
However most distro’s do comply with these standards quite well so that’s good news for us when we’re working on an unfamiliar linux system.
The following bulleted list shows the most common directories in a linux system which are part of the FHS.
If you’re not familiar with these directories then you will be after playing around in linux long enough, that’s for sure.
The entire FHS standard is not included in this post as the LPIC-1 certification doesn’t require us to know everything.
The list of directories above is what we would be tested on as these are the most important directories to know when working in a linux system.
Now let’s look at these FHS directories in a little more detail:
/
The forward-slash directory (/) is the top level of any linux system.
Every other file and directory will exist under this / (slash).
Think of it as the C: drive for now if you’re from a Microsoft Windows background.
Although this isn’t technically true due to partitioning and mount-points but I won’t go into detail about them here today.
This ‘slash’ usually get’s referred to as root. But the problem here is that there’s also a directory called /root so don’t get these two directories mixed up with each other.
I will cover the /root directory further down in this post but as you can see from the image below we have the /root directory inside of the / (root) directory:
The ‘/‘ refers to the root of the filesystem whereas the /root refers to the ‘root’ (admin) user.
/bin
The bin (short for ‘binary’) stores binary executable files.
Not every binary executable file in linux is stored in here but this directory stores many basic commands.
The commands in this directory usually ship with the linux system.
The commands stored here are not usually system commands and regular users can execute many of these commands without root privileges.
The ‘/sbin’ directory (system binary directory) usually holds the system commands.
/boot
When ever we partition our hard drive for a brand new linux installation, we usually (but not always) create a separate partition for this ‘/boot’ directory.
This directory is where the linux kernel is usually kept, along with the boot loader configuration files such as ‘grub’.
/dev
All of our linux devices can be found here, in the ‘/dev’ directory.
Our hard drives today are usually have a SATA connection and these devices are referred to as ‘sd’ in linux.
Older hard drives used the IDE connection and you will find these devices in the ‘/dev’ directory as ‘hd’.
CDROM drives can be seen usually as ‘CDROM’.
There are many more devices in linux but these are just some examples.
/etc
The ‘/etc’ directory usually holds configuration files.
This is the base directory as many more directories holding configuration files can exist in here too.
/home
Regular users home directories are usually stored in the ‘/home’ directory.
From my personal experience I would say that it’s a really good idea to have this ‘/home’ directory as a separate partition on your hard drive.
The reason being is that the linux operating system can be updated, or even broken and reinstalled, but the users files and settings will remain in tact!
/lib
The ‘/lib’ directory is home to library files for executables. Remember the ‘/bin’ directory above that stores binary files?
Well those binary executables share code.. we call this shared code ‘libraries’ and this is where they’re kept.
/proc
This is a virtual file system. In linux, everything is a file! When the system starts to boot up, it holds a lot of info in these files.
But these files are only temporary.
They loose their contents on a reboot and will be re-created.
This directory hold information about the current running system.
We can even view and manipulate some of these files while working in the system.
/root
Don’t confuse this ‘/root’ (slash root) directory with the other “root” directory (the forward slash /).
Remember how the ‘/home’ directory holds all the regular users personal files and settings?
Well this ‘/root’ directory is the home for the root user. The root user is kept separate from the others.
Because we can store the ‘/home’ directory on a separate partition, we CAN NOT store the root user account on a separate partition as it’s part of the linux system.
If problems exist with attached storage then we can fix them by logging in to the root account.
The ‘ls‘ command can be used to show us what files and directories exist in the ‘/root‘ directory.
However, because these files and directories belong to the admin user (root) we can’t just take a peek at them as a regular user for security reasons.
As you can see from the screenshot above, I get the “Permission denied” output on the terminal.
For us to see the files and directories that exist in the ‘/root‘ directory we need to use the ‘sudo‘ command.
Not only that, but the user also needs to have privileges to carry out this command.
When we first install linux we will usually create a new user. This user will have the sudo privileges needed.
The following screenshot shows the files and directories that exist in my ‘/root‘ directory by using the sudo command as a regular user named ‘anonymous’.
This ‘anonymous’ user has admin privileges:
/sbin
As I mentioned in the ‘/bin’ section, the ‘/sbin’ directory holds the system binary commands.
The system will use these commands and they are generally ran by the root user (super user).
Regular uses won’t have access to these commands for security reasons.
/tmp
Temporary files are stored in the ‘/tmp‘ directory.
When we are working in linux, the system will generally create files that we will only need to use on a temporary basis.
We wouldn’t want these temporary files to build up over time when they’re no longer in use and so any file stored in this /tmp directory will usually be deleted eventually.
The following screenshot shows temporary files stored in my /tmp directory:
/usr
The ‘/usr’ directory is usually ‘read-only’ and this directory can also be stored on a separate partition, separate hard drive or even a separate network drive.
This directory also stores binary executable files but this is usually used when regular users install programs, and it’s used on a regular basis.
The ‘/usr’ directory can hold further sub-directories such as ‘/usr/bin’ and ‘/usr/share’
/var
This ‘/var’ directory holds files that usually change on a regular basis and we usually call these types of files variable files for this reason.
This directory will hold log files and mail for example.
This directory can fill up it’s memory quite quickly and it can also be stored on a separate partition or hard drive.
/media
When we mount removable media then it’s mount point is usually here, in the ‘/media’ directory.
In the past, these mount points were usually kept in the ‘/mnt’ directory but in newer linux operating systems these mount points are now kept in ‘/media’.
Mounting removable media includes USB drives for example.
/mnt
The ‘/mnt’ directory is STILL part of the linux File System Hierarchy but this is now considered a legacy directory.
Today’s systems usually now use the ‘/media’ directory for mounting removable media, but the ‘/mnt’ directory was used for this purpose in the past, and in fact it still can be used if you wish to do so.
2.1 How To Find Files In The Linux FHS Using 'find' And 'locate' Commands
We can use the commands ‘find‘ and ‘locate‘ to find files in linux.
These two commands are in the LPIC-1 certification objectives and so it would be a good idea to get familiar with them.
Note that ‘find’ is much slower than ‘locate’ as ‘locate’ uses a database to search from.
However, the ‘find’ command runs in real-time whereas the ‘locate’ command relies on the database to be populated beforehand.
These are both really good tools for finding files and are each used for slightly different circumstances.
find
We can use the following command as an example of the ‘find’ command:
find / -name log The ‘/’ in the above command indicates where in the FHS to start searching from, and the string “log” is what we are looking for.
We WILL get lots of output stating that “Permission is denied” and this is because we would need to run this command as the super user (root) to look in some of these directories.
This command is not very user friendly however, as the name of the file needs to be an exact match.
We couldn’t search for the string “lo” for example if we wanted “log”.
The “find” command can be tuned to our liking by passing options (or parameters) to the command.
We can see what options are available to use with the ‘find’ command by looking in the manual:
man find locate
‘locate’ on the other hand, WILL find matches to your search query, whether its the full file name or not, and it will also find them much quicker!
Here is an example of using the ‘locate’ command:
locate log Where “log” is part of a file name that I would be searching for in the system.
Note that the ‘locate’ command uses a database called ‘updatedb’.
This database needs to be updated on a regular basis and so if you are searching for brand new files then the ‘locate’ may not find them until the database is updated again.
Usually the database is only updated once per day and it does this by using the ‘find’ command to populate the database.
if you have many files on your system then the updatedb command could take quite a while to finish.
This is the reason why it usually runs once in the middle of the night if your system is left powered on.
As the database doesn’t update in real time we would need to MANUALLY update the database if we ever wanted to use it for finding new files.
To do this we can execute the following command:
sudo updatedb The above command needs root privileges to run as we can see from ‘sudo’.
Why not try it out for yourself by creating a file, then using the ‘locate’ command to find it (which it shouldn’t), then update then database before trying to find it again with the ‘locate’ command.
Try It Yourself:
Now let’s try an example of the ‘locate’ command.
If we create a new file called new_file1.txt with the following command:
touch new_file1.txt then try to locate this new file with the following command:
locate new_file1.txt We can see from the output on the terminal that the file is not found and this is because the database only updates once per day.
we can manually update the database with the following command.
Note that we use ‘sudo’ as we need root privileges to run ‘updatedb’ and this command may take a while to complete:
sudo updatedb Now we can run the ‘locate’ command again to search for our new file with the following command:
locate new_file1.txt ‘locate’ should now find our new file and display it’s path.
2.2 Using The 'updatedb' Config File For The 'locate' Command
The updatedb.conf file can be found in the /etc directory and is used by the ‘locate’ command.
We can use this configuration file to manipulate the way that the ‘updatedb’ command will work.
We keep the database updated as to allow the ‘locate’ command to search through it.
The following command will display the contents of the updatedb.conf file:
sudo cat /etc/updatedb.conf The following screenshot shows the output of this command:
The paths that are entered at the “PRUNEPATHS” line indicates where the ‘locate’ command will NOT search.
The “PRUNEFS” line indicates the type of filesystems that will be omitted too.
2.3 More Commands
These next 3 commands are also specified in the LPIC-1 certification exam and can be used to give us more information on other commands.
whereis
The ‘whereis’ command tells us where a particular command is located.
The following command example shows the ‘whereis’ command being used on the ‘ls’ command:
whereis ls The ‘whereis’ command also outputs the location to the manual to that specific command too.
When we run the following command:
man ls it displays the manual file for the ‘ls’ command. Where is this file located? Well the ‘whereis’ command above just showed us.
which
The which command can be used to to find where a particular command lives on the system.
So the command:
which ls Will show us.
type
we can use the type command on another command to give us some details. we can find out if the command has an alias
we can use the following command:
type -a ls to tell us all about the ls command such as where it’s located too. (which is what the which command does)
Conclusion
Hopefully by now you have a good understanding on how to find system files and what commands will help you to find files and folders.
I wouldn’t expect anyone to suddenly know all of this info just by sitting and reading through this post once.
Not only will you need to review these files and directories over time but I would advise you to keep searching through the filesystem on a regular basis to become familiar with the linux hierarchical filesystem.
Resources:
A helpful resource can be found Here for a Question and Answer guide to help you pass the LPIC-1 certification!
