Image retained from the original article.
Originally published 21 June 2023; rewritten and reviewed on 15 October 2026.
A service fails, and the first challenge is deciding where to look. Linux’s directory layout becomes easier to understand when it is connected to operational questions: where is the configuration, where is the data and which files can disappear after a restart?
Follow the role of the directory
| Location | What I would look for |
|---|---|
/etc |
Host and service configuration |
/var/log |
File-based logs where the service uses them |
/var/lib |
Persistent state maintained by services |
/home |
Ordinary users’ home directories |
/root |
The root user’s home, not the filesystem root |
/tmp |
Temporary work subject to local cleanup policy |
/run |
Runtime state commonly recreated during boot |
/usr |
Installed programs, libraries and shared resources |
/opt |
Optional software installed under its own hierarchy |
/dev, /proc, /sys |
Device and kernel interfaces rather than ordinary document storage |
Distributions and packaging choices differ. Some traditional directories, such as /bin, may be links into /usr; inspect the host rather than assuming a diagram describes every installation.
Trace the application before moving anything
Read the service definition and configuration to locate the files it actually uses. A working directory and a data directory may be different. Logs may be collected by the system journal rather than written to a familiar file.
Before deleting a large directory, establish its owner and purpose. Removing a database’s state because it is under /var is not housekeeping. The path describes a role, not permission to discard the contents.
Practise with inspection commands
Use pwd, ls, stat, readlink and appropriate disk-usage tools to connect paths to real files. Make changes only after understanding the application and backup implications.
The useful knowledge is not reciting every directory name. It is knowing which question to ask next and where the system is likely to keep the evidence.