> For the complete documentation index, see [llms.txt](https://olb.gitbook.io/linux-essentials-certification/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://olb.gitbook.io/linux-essentials-certification/4.linux-operating-system/4.3-where-data-is-stored.md).

# 4.3 Where data is stored

**Weight 3**\
Key knowledge areas

* Programs and configuration
* Processes
* Memory addresses
* System messaging
* Logging

Partial list of the used files, terms and utilities

* ps, top, free
* syslog, dmesg
* /etc/, /var/log/
* /boot/, /proc/, /dev/, /sys/

***

## Filesystem

* Filesystem hierarchy is defined by **Linux Filesystem Hierarchy Standard (FHS)**.

## Programs

### Binary files

* 3 tier list
  * **/** for single user mode (no failure mode for eg.)
  * **/usr** for multi user program
  * **/usr/local** compiled locally or not provided by distro
* **/sbin** It contains essential binaries for system administration such as parted or ip.
* **/bin** It contains essential binaries for all users such as ls, mv, or mkdir.
* **/usr/sbin** It stores binaries for system administration such as deluser, or groupadd.
* **/usr/bin** It includes most executable files — such as free, pstree, sudo or man — that can be used by all users.
* **/usr/local/sbin** It is used to store locally installed programs for system administration that are not managed by the system’s package manager.
* **/usr/local/bin** It serves the same purpose as /usr/local/sbin but for regular user programs.
* NOTE: The **/opt** directory is sometimes used to store optional third-party applications.
* Other Regular users binaries:
  * **/home/$USER/bin**
  * **/home/$USER/.local/bin**

### Configuration files

#### /etc Directory

* **group** System group database.
* **hostname** Name of the host computer.
* **hosts** List of IP addresses and their hostname translations.
* **passwd** System user database — made up of seven fields separated by colons providing information about the user.
* **profile** System-wide configuration file for Bash.
* **shadow** Encrypted file for user passwords.
* Initialization files ending in rc:
* **bash.bashrc** System-wide .bashrc file for interactive bash shells.
* **nanorc** Sample initialization file for GNU nano (a simple text editor that normally ships with any distribution).
* Files ending in .conf:
* **resolv.conf** Config file for the resolver — which provide access to the Internet Domain Name System (DNS).
* **sysctl.conf** Config file to set system variables for the kernel.
* Directories with the .d suffix: add your own custom config without changing general config

#### Configuration Files in HOME (Dotfiles)

* **.bash\_history** It stores the command line history.
* **.bash\_logout** It includes commands to execute when leaving the login shell.
* **.bashrc** is specific to the Bash shell and is read each time a new interactive Bash shell is started. It is used for user-specific configurations and settings for interactive shell sessions.
* **.profile** is a more general profile file, read and executed during the login process, and applies to both login and non-login shell sessions. It sets up environment variables and configurations that should apply to the entire session, regardless of the shell used.

## Linux Kernel

* start with PID 1 (more often **systemd**)
* For processes to start executing, the kernel has to first be loaded into a protected area of memory.
* The kernel job is that of allocating system resources to processes.

## /boot

* Kernel resides in /boot
  * **config-4.9.0-9-amd64** Configuration settings for the kernel such as options and modules that were compiled along with the kernel.
  * **initrd.img-4.9.0-9-amd64** Initial RAM disk image that helps in the startup process by loading a temporary root filesystem into memory.
  * **System-map-4.9.0-9-amd64** The System-map file contains memory address locations for kernel symbol (variables, functions)
  * **vmlinuz-4.9.0-9-amd64** The kernel proper
  * **grub** Configuration directory for the grub2 bootloader.

## /proc

* virtual FS not written on disk (in memory)
* reflect current state of:
  * Running processes
  * Kernel configuration
  * System hardware
* **/proc/cpuinfo** : It stores information about the system’s CPU:
* **/proc/cmdline** : It stores the strings passed to the kernel on boot
* **/proc/modules** : It shows the list of modules loaded into the kernel

## /proc/sys

* This directory includes kernel configuration settings in files classified into categories per subdirectory. For instance:
  * /proc/sys/net/ipv4/ip\_forward
  * /proc/sys/kernel/pid\_max

## Hardware devices

### /dev Directory

* Block devices ( HDD, SSD,DVD, SD cards)
* Character devices (keyboard, console)
* **/dev/zero** It provides as many null characters as requested. /- **dev/null** Aka bit bucket. It discards all information sent to it.
* **/dev/urandom** It generates pseudo-random numbers.

### The /sys Directory

* great improvement on /proc/sys

## Memory

* RAM (cells for memory address) and Swap (hard disk)
* `free` parses /proc/meminfo

## Process

* PID : Process Identifier
* PPID : Parent Process Identifier
* `top` (dynamic view of processes)
  * M Sort by memory usage.
  * N Sort by process ID number.
  * T Sort by running time.
  * P Sort by percentage of CPU usage.
  * R Switch between descending/ascending
* `ps` (static view of processes)
  * `-f` full
  * `-v` memory used
  * `-ef` = `aux` all
  * `pstree` : process hierarchy
* `uptime` : system load

## System Logging and System Messaging

* **/var/log** Because logs are data that varies over time, they are normally found in /var/log. Some examples include:
* **/var/log/auth.log** It stores information about authentication.
* **/var/log/kern.log** It stores kernel information.
* **/var/log/syslog** It stores system information.
* **/var/log/messages** It stores system and application data.
* read log files with `less` or `tail`
* `last` reads /var/log/wtmp
* `logrotate` for logs rotation

### Kernel ring buffer

* /var/log/dmesg or `dmesg` to read Kernel logs

## System journal

* `journalctl`
  * `-k` for kernel logs
  * `-u` for specific unit or service
  * `-b` for boot message
  * `-f` for last messages
  * `-p` for error level
  * `-r` for reverse order - newest first