Where Things Live: The Filesystem Layout

You will rarely work on the exact same server twice, but every Linux box uses the same basic map of folders. Learn that map once, and you can find your way around any of them, even on your very first day.

Absolute vs. relative

cd /etc always takes you to the same place, no matter where you started - that's called an absolute path, and you can spot one because it starts with /. cd config depends entirely on which folder you were already in - that's a relative path. When you're not sure which to use, especially inside a script, an absolute path is the safer choice, because it always means exactly the same folder no matter where the script happens to run from.

ls -a lists everything in a directory, including dotfiles (names starting with .) that plain ls hides:

ls -a ~

.   .bash_logout  .cache   .fzf       .gitconfig  .rootfs  .sudo_as_admin_successful  .welcome
..  .bashrc       .config  .fzf.bash  .local      .ssh     .vim
                                                                                        .vimrc

Two entries are always there, even in an empty directory: . means "this directory itself," and .. means "the parent directory" - that's what cd .. actually uses. Everything else here is a dotfile: .bashrc (your shell's startup script from lesson 1), .ssh (your SSH keys), .config and .cache (per-app settings and cached data). Plain ls, without -a, would hide every single one of these and show nothing at all in a fresh home directory - which is exactly why most per-user configuration deliberately lives in dotfiles: out of the way during a normal ls, but never actually hidden from anyone who knows to ask.

The parts that matter on a server

A colleague says "the billing service is broken, check it out." Nobody told you where anything lives. Find it anyway - start with the two directories from the table above that are most likely to have what you need:

ls /var/log/

README         apt         bootstrap.log  dpkg.log        journal   private
alternatives.log  billing-svc  btmp        faillog   fontconfig.log  lastlog  wtmp

Most files here are the system's own logs (dpkg.log from package installs, btmp/wtmp/lastlog for login history). One entry doesn't belong to the system at all: billing-svc - a directory, named after the service, exactly as the table predicted:

cat /etc/billing-svc.conf

billing-svc.conf
shard_count=12

The convention held again - /etc/<service-name>.conf existed exactly where it should. One more place to check, /run, for anything the service left behind about its current, live state:

ls /run/

agetty.reload  credentials  initctl  motd.dynamic  sendsigs.omit.d  sshd      systemd  udev  utmp
billing-svc.pid  dbus     lock     mount      setrans        sshd.pid  tmpfiles.d  user

billing-svc.pid - a PID file, one process ID number written as plain text, identifying which running process is "the" billing service right now. Combined with the log file and the config, you've now located everything about a service you'd never seen before, using nothing but the standard layout.

Write down the three full paths you found - the log file, the config, and the PID file - one per line, into ~/findings.txt.