8.6 Filesystem Hierarchy Standard (FHS) & File Location (104.7)

8.6 Filesystem Hierarchy Standard (FHS) & File Location

Quick Summary: The Filesystem Hierarchy Standard (FHS) defines the standard directory structure and content requirements for Linux systems, ensuring interoperability between distributions and third-party software. Locating files, binaries, libraries, documentation, and configuration settings within this hierarchy requires a dedicated command toolkit: find performs deep, real-time filesystem traversal; locate performs fast indexed lookups against precompiled databases generated by updatedb; which searches the user's $PATH; whereis finds binaries, manual pages, and source trees; and type identifies shell builtins, aliases, and functions. Both FHS directory definitions and file search utilities are central to LPIC-1 Topic 104.7.

---

1. Filesystem Hierarchy Standard (FHS 3.0) Overview

The FHS categorizes directories along two primary axes:

• Shareable vs. Unshareable: Shareable files can be stored on one central host and accessed over the network by multiple clients (e.g., /usr, /opt, /srv); unshareable files contain host-specific data (e.g., /etc, /boot, /var/log).
• Static vs. Variable: Static files remain unchanged without administrator intervention (e.g., /bin, /lib, /usr/bin); variable files are continuously modified by running daemons and users (e.g., /var/log, /var/spool, /tmp, /run).

Comprehensive FHS Directory Reference Table

---

2. Key FHS Subdirectories & Exam Hotspots

1. The /usr Subhierarchy

• /usr/bin: Primary directory for non-essential executable commands.
• /usr/sbin: Non-essential system administration binaries.
• /usr/lib, /usr/lib64: Shared libraries for binaries in /usr/bin and /usr/sbin.
• /usr/local: Tertiary hierarchy used by system administrators for locally compiled software installed without package managers (e.g., /usr/local/bin, /usr/local/etc).
• /usr/share: Architecture-independent shared data (icons, fonts, timezone data).
• /usr/share/man: Standard location for system manual pages (man).
• /usr/share/doc: Application documentation and release notes.
• /usr/src: Kernel and application source code.

2. The /var Subhierarchy

• /var/log: System and daemon log files (e.g., /var/log/messages, /var/log/syslog, /var/log/journal).
• /var/spool: Queued application data waiting for processing (print queues, mail spools, cron jobs in /var/spool/cron).
• /var/cache: Application cache data (e.g., apt package cache, dnf metadata).
• /var/lib: Dynamic state information maintained by applications (e.g., package manager databases, database storage).
• /var/tmp: Temporary files that must be preserved across system reboots (unlike /tmp, which may be cleared on boot).

---

3. Real-Time Searching with find

The find utility traverses the filesystem hierarchy in real time, evaluating files against user-defined predicates and executing specified actions.

find [starting-path] [search-criteria] [actions]

Essential find Search Criteria Reference

find Actions: -exec, -delete, and -print0

# 1. Execute command once per file found (-exec ... {} \;):
$ find /var/log -name "*.old" -exec rm -f {} \;

# 2. Execute command with batched arguments (-exec ... {} +):
# Much faster because it launches fewer child processes:
$ find /tmp -type f -name "*.tmp" -exec rm -f {} +

# 3. Direct deletion action (-delete):
$ find /var/tmp -type f -atime +30 -delete

# 4. Safe null-terminated output for xargs:
$ find /srv/data -type f -print0 | xargs -0 chmod 644

---

4. Fast Indexed Searching: locate & updatedb

Unlike find, which scans physical storage disks in real time, locate queries a prebuilt, indexed database of the filesystem (typically stored at /var/lib/mlocate/mlocate.db or /var/lib/plocate/plocate.db). This makes locate virtually instantaneous.

The updatedb Indexer

The database is updated automatically via a daily cron or systemd.timer job running the updatedb command. Administrators can manually refresh the index immediately:

# Manually rebuild the locate database as root:
$ sudo updatedb

Configuration via /etc/updatedb.conf

The /etc/updatedb.conf file controls updatedb behavior:

• PRUNEFS: Filesystem types to exclude from indexing (e.g., nfs, proc, sysfs, tmpfs, iso9660).
• PRUNEPATHS: Directory paths to exclude from indexing (e.g., /tmp, /var/tmp, /media).
• PRUNENAMES: Directory names to skip (e.g., .git, .svn).

Key locate Command Options

# Find all files matching nginx.conf case-insensitively:
$ locate -i nginx.conf

# Count how many python script files are indexed:
$ locate -c "*.py"

---

5. Command Resolution Utilities: which, whereis & type

Linux provides three specialized tools for determining how command names are resolved.

1. The which Utility

The which utility takes a command name and searches the directories listed in the current user's $PATH environment variable, returning the absolute path of the first matching executable file:

$ which ls
/usr/bin/ls
$ which python3
/usr/bin/python3

2. The whereis Utility

The whereis utility searches standard system binary, manual page, and source code directories (independent of $PATH):

$ whereis tar
tar: /usr/bin/tar /usr/include/tar.h /usr/share/man/man1/tar.1.gz

$ whereis -b tar
tar: /usr/bin/tar

$ whereis -m tar
tar: /usr/share/man/man1/tar.1.gz

3. The type Shell Builtin (Exam Favorite)

The type command is a Bash built-in utility that describes how a given command name will be interpreted if typed into the shell: whether it is a shell builtin, an alias, a shell function, a keyword, or an external executable on disk.

# Inspecting builtins, keywords, and aliases:
$ type cd
cd is a shell builtin

$ type for
for is a shell keyword

$ type ll
ll is aliased to `ls -l --color=auto`

# Finding all matching instances in search order (-a):
$ type -a echo
echo is a shell builtin
echo is /usr/bin/echo

# Returning only the concise type identifier (-t):
$ type -t cd
builtin
$ type -t ls
alias
$ type -t grep
file

⚠️ LPIC-1 Trap — which vs. type on Shell Builtins: Running which cd or which kill often produces misleading results or errors because cd is a shell builtin that does not exist as an independent binary in $PATH. To accurately determine whether a command is a shell builtin or alias, always use the type command.