Linux Directory Structure Explained: /etc, /var, /home

Linux keeps everything in one tree that starts at /, the root directory. There are no drive letters like C:. Once you know what the main folders are for, you can find any config file, log or website on your VPS in seconds. This guide walks through each top-level folder and what you will find there on Ubuntu, Debian, AlmaLinux and Rocky Linux.

Before you start

SSH access to your Linux VPS. See Connect to your Linux VPS with SSH if you have not logged in yet.
Basic use of cd and ls. The Linux command line basics guide covers them.

List the top level of your own server to follow along:

Bash

ls -l /

The folders you will use most

/etc: configuration

/etc holds system-wide configuration files, almost all of them plain text. If you need to change how a service behaves, the file is very likely here. Examples:

/etc/ssh/sshd_config: the SSH server settings.
/etc/hostname and /etc/hosts: the server name and local name lookups.
/etc/nginx/ or /etc/httpd/: web server configs (Nginx, or Apache on AlmaLinux and Rocky).
/etc/apache2/: Apache on Ubuntu and Debian.
/etc/fstab: which disks are mounted at boot.
/etc/os-release: the distribution name and version.

Tip: Copy a file in /etc before you edit it, for example sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak. A known-good copy is the fastest way back.

/var: data that changes

/var stores files that grow or change while the server runs:

/var/log/: log files. Look here first when something breaks. Ubuntu and Debian log authentication to /var/log/auth.log; AlmaLinux and Rocky use /var/log/secure.
/var/www/: the usual place for website files on many setups, for example /var/www/html.
/var/lib/: application state, such as databases in /var/lib/mysql and Docker data in /var/lib/docker.
/var/cache/: cached data, including downloaded packages.
/var/spool/: queues, such as cron and mail.

When a disk fills up unexpectedly, /var/log and /var/lib are the usual suspects.

/home and /root: user folders

/home/ contains one folder per normal user, for example /home/deploy. Personal files, SSH keys (~/.ssh/) and shell settings live there.
/root/ is the home folder of the root user. It is kept apart from /home so root can log in even if /home is on a separate disk that fails to mount.

/usr: installed software

/usr holds programs and libraries installed by the package manager:

/usr/bin/: most commands you run, such as ls, nano and python3.
/usr/sbin/: system admin programs.
/usr/lib/: shared libraries.
/usr/share/: documentation, man pages and other shared data.
/usr/local/: software you install by hand, outside the package manager.

On current Ubuntu, Debian, AlmaLinux and Rocky releases, /bin, /sbin and /lib are symbolic links into /usr, so both paths point to the same files.

/opt and /srv

/opt/ is for self-contained third-party software that ships in its own folder, for example a vendor agent or an application you unpacked from an archive.
/srv/ is meant for data the server serves, such as website or FTP files. Some admins use it instead of /var/www. Either is fine; just be consistent.

/tmp: temporary files

/tmp is a scratch area every user can write to. Files here may be deleted on reboot or after a period of time, depending on the distribution's settings. Never keep anything important in /tmp.

/boot: the kernel

/boot contains the Linux kernel, the initial RAM disk and bootloader files. You rarely touch it by hand. Kernel updates manage it for you.

Warning: Do not delete files in /boot, /usr or /etc to free space. Removing the wrong file can stop the server from booting. Use the package manager to remove software instead.

Special folders you will meet

/dev/: device files. Your disk appears here as something like /dev/vda or /dev/sda.
/proc/ and /sys/: virtual folders created by the kernel. They show live system information. For example, cat /proc/meminfo shows memory details. They use no disk space.
/run/: runtime data such as process ID files. It is cleared on every boot.
/mnt/ and /media/: mount points for extra disks or temporary mounts.
/lost+found/: used by filesystem repair tools. It is normally empty.

Where things live: quick answers

A service's config: /etc/<service>/, for example /etc/nginx/.
Logs: /var/log/, or the systemd journal (journalctl).
Website files: usually /var/www/, sometimes /srv/ or a user's home folder.
Database files: /var/lib/mysql/ or /var/lib/pgsql/ and /var/lib/postgresql/.
Scheduled jobs: /etc/crontab, /etc/cron.d/ and per-user crontabs.
systemd service files: /etc/systemd/system/ for your own, /usr/lib/systemd/system/ for packaged ones.

Check it works

Try finding a few things yourself:

Bash

cat /etc/os-release
ls /var/log
ls -ld /home/* /root
du -sh /var/log

You should see your distribution's name and version, a list of log files, the user home folders, and the total size of your logs.

Troubleshooting

Permission denied when listing /root or some logs: these are restricted to root. Prefix the command with sudo.
A config folder from a guide does not exist: the package is not installed, or your distribution uses a different name. Apache, for example, lives in /etc/apache2 on Debian-based systems and /etc/httpd on AlmaLinux and Rocky.
The disk is full but your files are small: check /var/log, /var/lib/docker and /var/cache with sudo du -sh /var/*.
A file in /tmp disappeared: temporary cleanup removed it. Move anything you need to keep into your home folder.

Next steps

Practise moving around: Navigate folders in Linux with cd, ls and pwd.
Learn where each log is kept: Linux log file locations.
Running low on space? See Free up disk space on Linux.

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket