Navigating the Linux Filesystem: FHS, Find, and Locate

The Filesystem Hierarchy Standard (FHS)

If you've used Windows, you're familiar with drive letters like C:\ and D:\, each with its own directory tree. Linux takes a different approach. Everything exists under a single, unified tree structure starting from the root directory, denoted by a single slash (/).

This structure isn't random; it follows a convention called the Filesystem Hierarchy Standard (FHS). The FHS defines the purpose of major directories, ensuring that no matter which Linux distribution you're on (with minor variations), you can reliably predict where to find system binaries, configuration files, logs, and user data. This predictability is crucial for system administration and automation.

To get a comprehensive tour of this structure, the following video provides an excellent walkthrough.

A Quick Reference Guide to Key Directories

The video provided a great visual and verbal tour. Here's a summary of the most critical directories for a DevOps engineer, which you can use as a quick reference. For a more detailed text-based explanation, you can refer to the Baeldung article on "Linux Filesystem Structure".

• Binaries and Libraries (Executable Programs)

  • /bin: Essential user command binaries (e.g., ls, cp, cat) needed for basic system functionality, even in single-user mode.
  • /sbin: Essential system binaries (e.g., fdisk, reboot, ip) used for system administration.
  • /usr/bin: The primary location for most user-installed executable programs that are not essential for system booting.
  • /usr/sbin: Non-essential system administration binaries.
  • /lib, /lib64: Essential libraries needed by the binaries in /bin and /sbin.

• Configuration and System State

  • /etc: Contains all system-wide configuration files (e.g., /etc/ssh/sshd_config, /etc/nginx/nginx.conf). This is one of the most important directories you'll work in.
  • /boot: Files required for the boot process, including the Linux kernel and bootloader configuration (GRUB).
  • /dev: Contains device files. In Linux, "everything is a file," and this is where the system represents hardware like disks (/dev/sda), terminals, and other peripherals.

• Variable and User Data

  • /var: Stands for "variable." This is for files that are expected to grow in size, such as logs (/var/log), caches, and mail spools. You will spend a lot of time in /var/log when troubleshooting.
  • /home: Contains the personal home directories for each user on the system (e.g., /home/youruser). Your personal files, application settings (dotfiles), and documents live here.
  • /root: The home directory for the root superuser. It is separate from /home to ensure the root user can log in even if /home is on a separate, unmounted filesystem.
  • /tmp: A world-writable directory for temporary files. These files are typically deleted upon reboot.

• Special and Optional Directories

  • /proc: A virtual filesystem that provides real-time information about system processes and kernel parameters. Files here are not on disk; they are generated on the fly.
  • /opt: Reserved for "optional" add-on application software packages from third-party vendors (e.g., /opt/google/chrome).
  • /mnt, /media: Temporary mount points for filesystems. /media is typically used by the system for auto-mounting removable devices (USB drives, CDs), while /mnt is for temporary manual mounts by the administrator.

Finding Files on the System

Now that you have a map, let's learn how to navigate it. There are two primary commands for finding files: locate and find.

The Fast Way: locate

The locate command is incredibly fast because it doesn't search the filesystem in real-time. Instead, it searches a pre-built database of all file paths on the system.

How it works:

1. A background job (typically a cron job) runs updatedb daily to scan the filesystem and update a database, usually stored at /var/lib/mlocate/mlocate.db.
2. When you run locate, it simply queries this database.

Because of this, locate has a key limitation: it won't find files created since the last database update. You can manually update the database at any time by running:
sudo updatedb

The locate command is best used when you know the name (or part of the name) of a file and need to find its location quickly.

Example: You need to find the main Nginx configuration file.

# First, ensure the database is fresh (optional, but good practice if you just installed something)
sudo updatedb




# Now, locate the file
locate nginx.conf



# Output might include: /etc/nginx/nginx.conf

The Powerful Way: find

The find command is the powerhouse of file searching. It searches the filesystem in real-time, allowing you to search based on a wide array of criteria beyond just the name. This makes it slower than locate but infinitely more flexible.

The basic syntax is: find [path] [expression]

• [path]: Where to start searching (e.g., /, ., /home/youruser).
• [expression]: The criteria for the search (e.g., name, type, size, modification time).

Let's explore the criteria relevant to our learning outcome.

1. Finding by Name

This is the most common use case.

• -name "pattern": Case-sensitive search.
• -iname "pattern": Case-insensitive search.

The pattern can include wildcards, but you should quote them to prevent the shell from expanding them.

Example: Find all YAML files (.yml or .yaml) in the /etc directory.

find /etc -type f -name "*.yml" -o -name "*.yaml"

Here, we combine expressions: -type f ensures we only find files, and -o acts as a logical OR.

2. Finding by Type

The -type option lets you filter by what the file is.

• -type f: Regular file
• -type d: Directory
• -type l: Symbolic link

Example: Find all directories named bin anywhere under /usr.

find /usr -type d -name "bin"

3. Finding by Time

This is extremely useful for troubleshooting and system auditing. You can find files based on their modification time (-mtime), access time (-atime), or change time (-ctime).

You can specify time in days (-mtime) or minutes (-mmin).

• N: Exactly N days/minutes ago.
• +N: More than N days/minutes ago.
• -N: Less than N days/minutes ago.

Example 1: Find all files in your home directory modified in the last 24 hours (less than 1 day).

find ~ -mtime -1

(Note: ~ is a shortcut for your home directory)

Example 2: Find all files in /var/log that haven't been modified in over 30 days. This is great for log rotation and cleanup checks.

find /var/log -mtime +30

Practical Challenge

Time to put this knowledge to the test. Open a terminal on a Linux machine and try to answer the following questions using the commands you've learned.

1. What command would you run to quickly find all files on your system with "sshd_config" in their path?
2. Where would you expect to find the file that stores local user account information and their hashed passwords? (Hint: Think about FHS).
3. Write a command to find all files ending in .log inside the /var/log directory that have been modified in the last 2 hours.
4. Write a command to find all directories within your home directory (~) named project.

Conclusion

In this lesson, we established a foundational understanding of the Linux environment. You now have a mental map of the filesystem and know how to locate any file you need, whether quickly by name or through a powerful, granular search.

Key Takeaways:

• The Filesystem Hierarchy Standard (FHS) provides a logical and predictable structure for all Linux systems. Key directories include /etc for configs, /var for variable data like logs, /usr for installed programs, and /home for user data.
• The locate command is your tool for fast, name-based searches. It relies on a database that is updated by updatedb.
• The find command is your powerful, real-time search tool. It can find files and directories based on a wide range of criteria, including name (-name), type (-type), and modification time (-mtime, -mmin).

Preview of the Next Lesson:
Finding files is only half the battle. Often, you need to perform an action on the files you've found. In our next lesson, we will learn how to combine find with xargs to perform bulk operations on files and directories safely and efficiently. This will unlock a new level of command-line power and automation.