Exploring the System

Core idea

A Linux system is not a black box: most of its configuration is plain text, its layout follows a published standard (the Filesystem Hierarchy Standard), and you have read access to almost all of it as a regular user. The goal of this topic is to look around — using just three commands — until the structure of the system stops feeling mysterious. The commands are ls (which you already know, but with options that change what it tells you), file (which guesses what a file actually contains), and less (which lets you read a text file page by page without opening an editor).

The deeper idea underneath is the Unix slogan "everything is a file": directories are files, devices are files (/dev/sda is your disk, /dev/null is the bit bucket), running processes have files (/proc), and kernel state has files (/sys). Learning the directory tour is therefore learning how a Linux system represents itself to itself.

Why it matters

Mental model

ls -l: reading the long format

Run ls -l in any directory and you get rows like this:

-rw-r--r-- 1 jay jay 32059 2025-04-03 11:05 notes.txt

Eight fields, in order: the type-and-permission string (-rw-r--r--), the link count (1), the owner (jay), the group (jay), the size in bytes (32059), the modification timestamp, and the filename. The first character of the permission string is the file type: - for a regular file, d for a directory, l for a symbolic link, c for a character device, b for a block device. The remaining nine characters are the read/write/execute permissions; that is a topic on its own.

A tour of the top-level directories

Copy sourceZoom

Useful destinations on the tour

| Directory | What's there | |---|---| | /etc | All system-wide configuration, in plain text. passwd, fstab, crontab live here. | | /var/log | System log files. syslog and messages are the usual entry points. | | /proc | A virtual filesystem; reading /proc/cpuinfo or /proc/meminfo asks the kernel. | | /dev | Devices as files. /dev/sda is your first disk, /dev/null discards anything written to it. | | /usr/bin | The installed programs you run from the shell (often thousands). | | /usr/share/doc | Per-package documentation, often the only place to find an example config file. | | /home/<you> | Your data and dotfiles. The only branch a normal user can usually write to. |

Symbolic links: one file, many names

A library might be installed as libc-2.6.so but every program asks for libc.so.6. Rather than rewriting every program when the library updates, the system creates a symbolic link — a tiny file whose contents are the path of the target. ls -l shows it with a leading l and an arrow:

lrwxrwxrwx 1 root root 11 May 26 09:00 libc.so.6 -> libc-2.6.so

Upgrade the library, repoint the link, and every program quietly picks up the new version.

Practical application

Reading what file and less tell you

The pattern for exploration is always the same: cd somewhere, ls -l, pick something interesting, ask file what it is, then less it if it is text.

Keyboard commands inside less

| Key | Action | |---|---| | Space or PageDown | Forward one page | | b or PageUp | Back one page | | Up / Down arrows | One line at a time | | g | Jump to top | | G | Jump to bottom | | /word | Search forward | | n | Repeat previous search | | h | Help | | q | Quit |

less was named as a joke — its predecessor was called more and could only page forward. "Less is more" is the Unix designer's idea of humour.

Example

You inherit a Linux server and want to learn three things about it: which version of the OS is installed, who else has an account on it, and what is using the most disk space.

# 1. OS identity
$ file /etc/os-release
/etc/os-release: ASCII text
$ less /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
...
(q to quit)

# 2. Who has an account
$ less /etc/passwd
root:x:0:0:root:/root:/bin/bash
...
jay:x:1000:1000:Jay,,,:/home/jay:/bin/bash
backups:x:1001:1001::/home/backups:/usr/sbin/nologin
(q to quit)

The /etc/passwd listing tells you it is Debian 12, there are two human-shaped accounts (jay and backups), and backups has its shell set to /usr/sbin/nologin — meaning that account can own files but cannot log in interactively. You have just performed a basic system audit using only file and less. The third question (disk usage) is a one-liner with du and pipes, which the next topic begins to set up.

Related lessons