Important system directories

A handful of top-level directories account for almost everything you will do on a server. Learn their jobs and the rest of the tree stops looking mysterious.

/etc contains system-wide configuration. /var contains changing data such as logs, caches, and application state. /usr contains installed programs and shared data.

A useful rule of thumb: configuration lives in /etc, data the system writes lives in /var, and the programs themselves live in /usr.

You can peek at each one right now:

cat /etc/hostname
# webserver-01

ls /var/log | head -3
# apt
# auth.log
# syslog

ls /usr/bin | wc -l
# 1147

One machine name in a plain text file, a directory of logs, and over a thousand installed commands — each directory doing exactly its job.

Home directories and the rest

/home contains regular user homes, one folder per account. /root is the root user home — note that it sits outside /home, and regular users cannot even list it:

ls /root
# ls: cannot open directory '/root': Permission denied

That error is correct behavior, not a problem.

/tmp stores temporary files, and its contents do not survive long: anything there can disappear on reboot. /dev exposes device interfaces as files — /dev/null, the writable black hole you will meet in shell tutorials, lives there.

The mistake to avoid

When you need to change how an installed program behaves, resist editing its files under /usr. Those files belong to the package manager, and the next upgrade overwrites them, silently reverting your change. The supported knobs are in /etc — that separation is the whole reason the two directories exist.

Do not memorize every directory. Learn the purpose of the major ones and use package documentation to find specific files. When a tutorial mentions a path, you should now be able to guess what kind of file it is from the first component alone.