2. Linux - Understanding the Linux Filesystem

 

Introduction

In this session, I focused on one of the most important Linux fundamentals: the filesystem.

At first, the Linux filesystem can look confusing. There are many directories, and each of them has a specific purpose.

The goal of this session was not to memorize a list of folders.

The goal was to understand:

• where system configuration is stored
• where user data is stored
• where logs and service data are stored
• what /proc and /sys are
• what a filesystem and a mount point are
• how to investigate disk usage

Let's break it down step by step.

 

1. The Linux Filesystem Starts at /

Unlike Windows, Linux does not organize the system around drive letters such as C: or D:.

Everything starts from:

/

This is called the root filesystem.

From there, Linux has a directory structure containing different parts of the operating system.

Some of the most important directories are:

/
├── etc
├── var
├── home
├── tmp
├── opt
├── proc
└── sys

Each directory has a different role.

 

2. /etc — Configuration

The /etc directory contains system and service configuration.

For example, configuration related to:

• SSH
• Nginx
• Fail2ban
• networking
• system services

So when I need to investigate how a service is configured, /etc is one of the first places I expect to look.

For example:

ls -lah /etc

This shows the contents of /etc together with useful information such as permissions and file sizes.

 

 

 

3. /var — Changing Data

The /var directory contains data that changes while the system is running.

This includes things such as:

• logs
• cache
• service data

For example:

ls -lah /var

One important lesson here is that /var can grow significantly over time.

This becomes especially important when troubleshooting a server with a nearly full disk.

 

4. /home — User Data

User files are normally stored inside /home.

For example:

/home/ex3

This is where user-specific files and directories can be located.

So a simple mental model is:

/etc  → configuration
/var  → changing system/service data
/home → user data

 

5. /tmp — Temporary Files

/tmp is used for temporary files.

Applications and users can use it when temporary data is needed.

For example:

ls -lah /tmp

The important thing is to understand its role rather than simply memorize the directory name.

 

 

6. /opt — Additional Software

/opt is commonly used for additional applications or software.

For example:

ls -lah /opt

On a server, this can be useful when applications have been installed outside the standard system locations.

 

 

7. /proc — Processes and Kernel Information

Now things get more interesting.

/proc is not a normal directory containing ordinary files.

It is a virtual filesystem.

It provides information about processes and the state of the Linux kernel.

For example:

cat /proc/1/comm

This shows the name of the process with PID 1.

We can also inspect:

cat /proc/1/status

This provides more detailed information about that process.

We can think about /proc like this:

/proc
   ↓
information about
processes + kernel state

 

8. PID and PPID

While working with /proc, I also looked at two important concepts:

PID — Process ID

A number that identifies a process.

PPID — Parent Process ID

The PID of the process that started another process.

For example:

PID 100
   ↓
PID 200
   ↓
PID 300

In this example:

PID 300
PPID = 200

This parent-child relationship becomes very useful when investigating processes on a Linux server.

 

 

9. PID 1

One particularly important process is:

PID 1

On the system used in this session, PID 1 is:

systemd

It is the main process responsible for managing the system and services.

We can verify information about it through /proc:

cat /proc/1/comm

 

10. /sys — Hardware and Kernel Information

Another special filesystem is:

/sys

Like /proc, it is a virtual filesystem.

It contains information related to:

• devices
• hardware
• the kernel

For example:

ls /sys/devices

This allows us to see devices known to the Linux kernel.

A simple mental model is:

/proc → processes + kernel state

/sys  → devices + hardware + kernel

 

11. df — How Much Disk Space Do I Have?

Now we get to something extremely practical.

Imagine someone tells me:

"The server is running out of disk space."

The first question is:

How full is the filesystem?

I can use:

df -hT

Here:

-h → human-readable
-T → filesystem type

The important thing is that df tells me about the filesystem itself:

How much space do I have?
How much is used?
How much is available?

 

12. du — What Is Actually Using the Space?

Now imagine that df tells me:

The filesystem is almost full.

But that doesn't tell me what is consuming the space.

This is where du becomes useful.

For example:

du -hd1 /var

This helps identify which directories inside /var are using the most space.

We can continue going deeper:

du -hd1 /var/lib

This gives us a more detailed picture.

The difference is important:

df → How much space is used?

du → What is using the space?

 

13. lsblk — What Disks Do I Have?

Another important command is:

lsblk -f

It shows information about:

• disks
• partitions
• filesystems
• UUIDs
• mount points

This helps answer a different question:

"What storage devices and filesystems does this server have?"

So now we have three very useful tools:

df
↓
How much space?

du
↓
What is using the space?

lsblk
↓
What disks and filesystems do I have?

 

14. What Is a Mount Point?

A mount point is a directory through which a filesystem becomes accessible.

For example:

/dev/sdb1
     ↓
   mount
     ↓
/mojedokumenty

After mounting, /mojedokumenty provides access to the filesystem on /dev/sdb1.

An important detail:

Creating the directory alone:

mkdir /mojedokumenty

does not mount a disk.

The directory is simply a directory until a filesystem is actually mounted there.

 

15. Disk → Partition → Filesystem → Mount Point

This was one of the most important mental models from this session.

Think about storage like this:

Disk
 ↓
Partition
 ↓
Filesystem
 ↓
Mount point
 ↓
Access to data

For example:

/dev/sdb
   ↓
/dev/sdb1
   ↓
ext4
   ↓
/mojedokumenty

Understanding this relationship is much more useful than memorizing individual commands.

 

16. A Real Troubleshooting Workflow

Let's imagine a real server incident.

The filesystem / is almost full.

I don't immediately start deleting files.

First:

df -hT

I confirm that the filesystem is actually full.

Then:

du -hd1 /

I investigate which directory is consuming the space.

Suppose /var looks suspicious.

Then:

du -hd1 /var

I go one level deeper.

If necessary:

sudo du -hd1 /var/lib

Now I can continue investigating until I find the actual source of the disk usage.

The important part is the process:

Observation
    ↓
Collect data
    ↓
Find suspicious area
    ↓
Investigate deeper
    ↓
Identify the cause
    ↓
Decide what can safely be changed

And one important rule:

I don't delete anything until I understand what it is and whether it is needed.

 

17. sudo and Permission Denied

During Linux administration, I will sometimes encounter:

Permission denied

This means that the current user does not have permission to access a particular file or directory.

When appropriate, I can use:

sudo

to execute a command with administrator privileges.

For example:

sudo du -hd1 /var/lib

But sudo should not mean:

"Just run everything as root."

It should mean:

"I understand why I need elevated privileges for this operation."

 

18. The Most Important Takeaway

After this session, I want to remember these four questions:

df
↓
How much space do I have?

du
↓
What is using the space?

lsblk
↓
What disks and filesystems do I have?

mount point
↓
Where is the filesystem accessible?

And for the Linux filesystem itself:

/etc  → configuration

/var  → logs, cache, service data

/home → user data

/tmp  → temporary files

/opt  → additional software

/proc → processes and kernel information

/sys  → devices, hardware and kernel information

 

What I Actually Learned

The biggest lesson from this session wasn't a particular command.

It was learning to build a mental model of the Linux system.

When something goes wrong, I need to know where to look.

If I have a configuration problem:

/etc

If I am investigating logs or service data:

/var

If I am investigating processes:

/proc

If I am investigating devices or kernel-related information:

/sys

If I have a disk-space problem:

df → du → lsblk

That is much more useful than simply memorizing commands.