Filesystem Basics
Basic Linux filesystem notes.
This page explains files, directories, paths, mounts, disk usage, and common filesystem locations.
What is a filesystem?
A filesystem is how Linux organizes and stores files on disk.
Examples of filesystems:
xfs
ext4
btrfs
nfs
tmpfs
RHEL commonly uses XFS for many filesystems.
The root filesystem
Linux starts from:
/
This is called the root of the filesystem.
Everything is under /.
Examples:
/home
/etc
/var
/tmp
/usr
/root
Absolute path
An absolute path starts from /.
Example:
/etc/hosts
/var/log/messages
/home/user/file.txt
Relative path
A relative path starts from the current directory.
Example:
cd Documents
cat notes.txt
If you are in:
/home/user
then:
Documents
means:
/home/user/Documents
Show current directory
pwd
List files and directories
ls
Detailed view:
ls -lah
Meaning:
-l = long listing
-a = include hidden files
-h = human-readable sizes
Common Linux directories
/home
User home directories.
Example:
/home/user
/root
Home directory for the root user.
/etc
System configuration files.
Examples:
/etc/hosts
/etc/fstab
/etc/ssh/sshd_config
/var
Variable data like logs, caches, spool files, and application data.
Examples:
/var/log
/var/tmp
/var/spool
/tmp
Temporary files.
Files here may be deleted automatically.
/usr
Installed software and shared system files.
Examples:
/usr/bin
/usr/sbin
/usr/lib
/bin and /sbin
Command binaries.
On many modern systems, these may be symlinks to locations under /usr.
/dev
Device files.
Examples:
/dev/sda
/dev/null
/dev/mapper/
/proc
Virtual filesystem with process and kernel information.
Examples:
/proc/cpuinfo
/proc/meminfo
/proc/swaps
/sys
Virtual filesystem with kernel and device information.
/mnt
Temporary mount points.
/media
Mount points for removable media on some systems.
Hidden files
Files starting with . are hidden.
Examples:
.bashrc
.ssh
.profile
Show hidden files:
ls -la
File types
In ls -l, the first character shows file type.
Example:
-rw-r--r-- file
drwxr-xr-x directory
lrwxrwxrwx symlink
Meaning:
- = regular file
d = directory
l = symbolic link
Symbolic links
A symlink points to another file or directory.
Create symlink:
ln -s /real/path /link/path
Show symlink target:
ls -l /link/path
Disk usage
Show filesystem usage:
df -h
Show filesystem type:
df -Th
Show size of a directory:
du -sh /path
Show largest folders one level deep:
sudo du -h --max-depth=1 /path | sort -h
Example:
sudo du -h --max-depth=1 /var | sort -h
Mounts
A mount connects a filesystem to a directory.
Show mounted filesystems:
findmnt
Show disk usage:
df -h
Show block devices:
lsblk
/etc/fstab
/etc/fstab defines filesystems that should mount automatically.
View it:
cat /etc/fstab
Example line:
UUID=xxxx-xxxx /data xfs defaults 0 0
Be careful when editing /etc/fstab. A bad entry can affect boot.
File ownership
Files have an owner and group.
Show ownership:
ls -l file.txt
Change owner:
sudo chown USER:GROUP file.txt
Recursive ownership change:
sudo chown -R USER:GROUP /path
Use recursive changes carefully.
File permissions
Show permissions:
ls -l file.txt
Example:
-rw-r--r--
Permissions are explained more in:
Permissions Explained
Find files
Find by name:
find /path -name "filename"
Example:
find /etc -name "*.conf"
Find files only:
find /path -type f -name "*.log"
Find directories only:
find /path -type d -name "directory_name"
Search inside files
grep "text" file.txt
Recursive search:
grep -R "text" /path
Case-insensitive:
grep -Ri "text" /path
Common filesystem troubleshooting
Disk is full
Check:
df -h
sudo du -h --max-depth=1 /var | sort -h
Inodes are full
Check:
df -i
This can happen when there are too many small files.
Deleted files still use space
Check:
sudo lsof | grep deleted
A process may still hold a deleted file open.
Mount is missing
Check:
findmnt
df -h
cat /etc/fstab
systemctl --failed
journalctl -b -p err
First command set
pwd
ls -lah
df -h
df -Th
df -i
du -sh /path
findmnt
lsblk
lsblk -f
blkid
cat /etc/fstab
Dangerous actions
Be careful with:
rm -rf
chmod -R
chown -R
mkfs
wipefs
fdisk
parted
editing /etc/fstab
unmounting production filesystems
These can delete data or break boot/mounts.