FHS (FHS)
The FHS is the map of where things live on a Linux system. Configuration files go in one place, programs in another, logs in a third. Because most distributions follow the same map, once you learn it you know where to look on almost any Linux machine. It is the reason every Linux admin knows logs are under /var/log.
The Filesystem Hierarchy Standard (FHS), maintained by the Linux Foundation (version 3.0), defines the layout of a Unix-like filesystem.
Key directories:
| Path | Contents |
|---|---|
/ | Root of the whole tree |
/etc | System configuration (text files) |
/home | User home directories |
/root | Root user’s home |
/usr/bin, /usr/sbin | Programs installed by the package manager |
/usr/local | Software you installed by hand |
/opt | Self-contained third-party apps |
/var | Data that changes: /var/log, /var/lib, /var/cache |
/tmp | Temporary files, cleared at reboot on many systems |
/boot | Kernel, initramfs, GRUB files |
/dev | Device files (/dev/sda, /dev/null) |
/proc, /sys | Virtual files exposing kernel and hardware state |
/mnt, /media | Mount points for temporary and removable media |
/srv | Data served by this system (web, FTP) |
Merged /usr: on modern Ubuntu, /bin, /sbin, and /lib are symlinks into /usr.
Rule of thumb: config in /etc, logs and state in /var, your own files in /home. Back up /etc and /home and you have most of what matters on a basic system.
Exploring the hierarchy
$ ls /
bin boot dev etc home lib media mnt opt proc root run sbin srv sys tmp usr var
# The official description of each directory on your system
$ man hier
# Merged /usr symlinks
$ ls -l /bin
lrwxrwxrwx 1 root root 7 Apr 20 2026 /bin -> usr/bin
# Which package owns a file?
$ dpkg -S /usr/bin/ls
coreutils: /usr/bin/lsKnowing the FHS is what lets you walk onto an unfamiliar server and find its config, logs, and data in seconds. It also tells you where to put things: your scripts in /usr/local/bin, app data in /srv or /opt, never hand-edited files under /usr where the next package update will overwrite them. Disk-full alerts usually trace to /var (logs, caches, Docker images), which is why many servers give it its own partition.