Day 4 - Directory Hierarchy and File System Management

📌 Key Takeaways

• Linux has no drive letters. Everything is a single tree growing out of one root (/).
• The names and roles of directories are fixed by a standard called FHS — /etc configuration, /var things that change, /bin commands.
• /proc is not on disk. It is a virtual file system that the kernel builds in memory.
• Attach with mount and detach with umount. A directory that is in use can't be detached.
• df is file system capacity, and du is usage by path. Memorize them as a pair.

One Tree

                    /   (root)
      ┌────────┬────────┼────────┬────────┬────────┐
    /bin     /etc     /home    /var     /usr     /proc
  executables config   users    variable applications kernel info
                                data

• There are no drive letters like Windows' C: and D:. A new disk is also attached somewhere in the tree to be used.
• The root / is the top-level directory, and it is different from /root, the home of the root user.

FHS — What Is in Which Directory

Memorize the values that are asked as pairs together.

Paths one level further down also show up as answer choices.

• Knowing where the names come from makes them less confusing — /etc is configuration, /var is variable (things that change), /opt is optional (additional packages), /sbin is system binaries, and /dev is devices. /usr is not a user's home. User homes are in /home.
• Recent distributions often make /bin, /sbin, and /lib symbolic links to /usr/bin, /usr/sbin, and /usr/lib. Even so, the division of roles is still what gets tested.
• When /tmp is cleared depends on the distribution's settings. Understand it as "a place for temporary files that you shouldn't expect to last long."

/proc — A File System That Isn't on Disk

cat /proc/cpuinfo      # CPU info
cat /proc/meminfo      # memory info
cat /proc/version      # kernel version
ls /proc/1             # info of the PID 1 process

• The files in /proc are not stored on disk. The kernel builds and shows them the instant you read them. Often their size is shown as 0.
• A similar virtual file system is /sys (device and kernel settings).
• /dev is special too. It holds files that point to devices, not actual data.

• A numbered directory under /proc is a running process. When the process ends, the directory disappears too.

Attaching and Detaching — mount and umount

mount                          # the entire current mount state
mount /dev/sdb1 /data          # attach sdb1 at /data
mount -t ext4 /dev/sdb1 /data  # specifying the file system type
mount -o ro /dev/sdb1 /data    # read-only
umount /data                   # detach by mount point
umount /dev/sdb1               # detach by device name
mount -a                       # mount every entry in /etc/fstab

Two pitfalls. ① It's umount, not unmount. There is no n. ② A file system in use can't be detached. If you are inside that directory or a process has a file open there, you get a device is busy error. Get out and try again, and if it still fails, check who is holding it with lsof or fuser.

• If files originally existed at the mount point (/data), they are hidden. They don't disappear, and are visible again when you detach.
• To attach automatically at boot, write it in /etc/fstab (covered in W2).

One Cycle of Mounting

$ sudo mkdir /data                       ← the mount point must exist beforehand
$ sudo mount /dev/sdb1 /data
$ mount | grep sdb1
/dev/sdb1 on /data type ext4 (rw,relatime)
$ cd /data
$ sudo umount /data
umount: /data: target is busy.
$ cd ~
$ sudo umount /data

• The mount point must be an existing directory. mount doesn't create the directory for you.
• The argument order of mount is device first, mount point after — mount [options] device directory.
• umount accepts either the device name or the mount point.
• The first umount above failed because the shell was inside /data. Once it stepped out, it detached.

• Write options joined with commas — -o ro,noexec. No spaces.

Three Places Where Mount Information Is Written

# device         mount point type   options    dump  fsck order
/dev/sdb1        /data      ext4   defaults   0     2

• /etc/fstab has 6 fields separated by whitespace — device, mount point, file system type, options, dump flag, fsck order.
• Tell them apart this way: "planned" is fstab, "current" is mtab. What you see when you type mount with no arguments is the current list.
• If it's in fstab, even giving just one side, as in mount /data, finds the rest from fstab and attaches it.

Viewing Capacity — df and du

df -h                   # in human-readable units (G, M)
df -T                   # including file system type
df -i                   # inode usage
du -h /var/log          # capacity per path
du -sh /var/log         # total only (summary)
du -sh * | sort -h      # biggest first, from the current location

• -h is human-readable. It is used with the same meaning in both commands.
• The -s in du -sh is summary — it gives only the total without listing each sub-item.
• For the problem "the disk is full," find which file system with df -h, and narrow down which directory with du -sh.

$ df -hT
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sda2      xfs        50G   12G   38G  24% /
/dev/sda1      xfs      1014M  180M  835M  18% /boot
/dev/sdb1      ext4       99G   89G  4.9G  95% /data
tmpfs          tmpfs     1.9G     0  1.9G   0% /dev/shm

$ du -h /data/logs
1.2G    /data/logs/2026-08
3.4G    /data/logs/2026-09
4.6G    /data/logs
$ du -sh /data/logs
4.6G    /data/logs

• With no options, du prints one line per subdirectory and gives the total at the end. -s leaves only that last line.
• Even if you give a directory, as in df /data/logs, df shows the whole file system that directory belongs to. It doesn't tell you the size of a single directory.

There are cases where capacity remains but files can't be created. The inodes have run out. It happens when there are very many small files. Check with df -i.

Checking — fsck

fsck /dev/sdb1          # check
fsck -y /dev/sdb1       # yes to every question
e2fsck -f /dev/sdb1     # ext family, forced check

• It is a command that checks and repairs the integrity of a file system.
• ⚠️ Always run it with the file system unmounted. Checking while mounted can damage the file system.
• It sometimes runs automatically at boot after an abnormal shutdown. The 6th field of /etc/fstab decides the check order (1 for root, 2 for the rest, 0 for no check).

• The correct order is umount → fsck → mount. File systems that can't be detached, like the root (/), are checked during the boot process or in recovery mode.
• Give the argument to fsck as the device name (/dev/sdb1), not the mount point.
• File fragments that couldn't be placed anywhere during repair are collected in that file system's lost+found directory.

Lookup Commands Used Alongside

Tomorrow we bundle this week's permissions and file systems into one summary.

📖 Glossary

• FHS : Filesystem Hierarchy Standard. The convention that fixes directory names and roles in Linux.
• Root directory (/) : The very top of the whole file system. Different from /root, root's home.
• Mount : Connecting a file system to a specific point in the directory tree.
• Mount point : The directory where a file system is attached. Whatever was originally there is hidden.
• Virtual file system : A file system like /proc and /sys that the kernel builds and shows, not a disk.
• df : The command for viewing capacity per file system.
• du : The command for viewing usage per path. -sh gives the total.
• fsck : The command that checks and repairs file system integrity. Run it while unmounted.