BOOT PROCESSS

BOOT FOLDER CONTAINS KERNEL FILES. IT ALSO CONTAINS BOOTLOADER FILES KNOWN AS
GRUB / LILO

/dev DEVICE DRIVERS ARE STORED HERE. DRIVER FILES ARE CALLED SPECIAL FILES

/etc CONTAINS ALL CONFIGURATION FILES

/bin CONTAINS ALL USER COMMANDS. IT IS STORED HERE AS FILES.

COMMANDS CAN RUN FROM ANY LOCATION

/sbin SUPER BIN. THERE ARE COMMAND FILES. ONLY ROOT USER CAN RUN THESE COMMANDS
(MOST OF THE COMMANDS)

lost+found IS CONTAINS DATA RECOVERED FILES

/usr IT CONTAINS ALL SOFTWARES / APPLICATIONS

/lib IT CONTAINS ALL .so FILES (SHARED OBJECT FILES)

IN WINDOWS WE HAVE .dll FILES. IN LINUX WE HAVE .so FILES

/var ALL LOG FILES ARE SAVED HERE.

IN WINDOWS WE HAVE EVENTVIEWER. IN LINUX WE HAVE LOGS.

IN WINDOWS WE HAVE “USERS” IN C DRIVE. SIMILARLY IN LINUX WE HAVE /home DIRECTORY

ROOT IS A SUPER USER

VAR

/var IT CONTAINS LOG FILES. SIZE OF DIRECTORY INCREASES

/var/logs/messages IT STORES COMMON LOGS. EVENT VIEWER IN WINDOWS

DIFFERENT WAYS TO VIEW MESSAGE FILE

1.# less /var/logs/messages WILL SHOW STARTING 10 LINES

2.# more /var/logs/messages WILL SHOW LAST 10 LINES

3.#head /var/logs/messages head -20 WILL SHOW STARTING 20 LINES

4.# tail -f /var/log/messages IT SHOWS REALTIME LOGS

# tailf /var/logs/messages

TO VIEW LOGS FOR 6TH JUNE

# grep “June 6 13:04:10” /var/log/messages

dmesg IT’LL SHOW OS DETECTED HARDWARE LOGS

dmesg = DEVICE MANAGER IN WINDOWS

# dmesg

TO CHECK ETHERNET DRIVER AND DETAILS

# dmesg | grep -i eth

dmesg LOCATION /var/log/dmesg

TO VIEW ALL INFORMATION OF SYSTEM’S MOTHERBOARD

# dmidecode

# biosdecode

Wtmp IT SHOWS LOGIN INFORMATION

THIS FILE IS ENCRYPTED AND CANNOT BE MODIFIED

HOW TO VIEW wtmp FILE

# last

last COMMAND DECRYPTS THE FILE AND SHOWS RESULTS

SYSTEM REBOOT INFO IS ALSO AVAILABLE IN wtmp FILE

IF wtmp FILE IS DELETED, last WILL NOT SHOW ANY INFORMATION

IT IS ALSO KNOW AS AUDITING

TO VIEW LAST 10 REBOOTS

# last | grep -i reboot | head

TO VIEW OLD 10 REBOOTS

# last | grep -i reboot | tail

btmp BAD LOGIN INFORMATION

# lastb

secure AUTHENTICATION LOGS + SSH + PAM + SU LOGS

/var/log/anaconda/anaconda.log INSTALLATION LOGS

/var/log/Xorg.0.log GUI LOGS

/var/log/boot.log BOOT PROCESS LOGS

syslog SERVICE MANAGES / GENERATES ALL THE LOGS

rsyslog IS ENHABCED OF syslog

rsyslog SERVICE SHOULD ALWAYS BE RUNNING

RHEL 6 rsyslog

RHEL 7 / 8 journald JOURNALCTL TOOL SHOWS REPORT

JOURNALD BINARY FETCHES INFORMATION FROM rsyslog AND WITH HELP OF journalctl TOOL
SHOWS REPORT

JOURNALD IS MANAGED BY systemd SERVICE

journalctl CONSOLIDATES ALL THE LOGS AND SHOWS THEM

YOU CAN USE FLAGS WITH journalctl TO VIEW SPECIFIC LOGS

ETC

/etc IT CONTAINS CONFIGURATION AS TEST FILES

/etc HAS FILES IN READABLE FORMATS

AT TIMES IT MAY CONTAIN BINARY FILES AS WELL

BIN

/bin IT CONTAINS ESSENTIAL FILES RUN BY ALL USERS

/usr/bin IT CONTAINS NON ESSENTIAL FILES RUN BY ALL USERS

/sbin IT CONTAINS ESSENTIAL FILES RUN BY ROOT

/usr/bin IT CONTAINS NON ESSENTIAL FILES RUN BY ROOT

LIB

/lib (LIBRARIES) IT CONTAINS ALL .so FILES (SHARED OBJECT)

.so ARE BINARY PROGRAMS. IT ITS NOT IN /lib, YOU’LL FIND IT IN /lib64

IN WINDOWS .so FILES ARE CALLED .dll FILES

WHEN YOU RUN VLC.exe, amr.dll , mp3.dll , …. FILES START WORKING

.dlls ARE DEPENDANCIES FOR APPS / COMMANDS / PROGRAMS

SIMILARLY LINUX HAS .so FILES

LDD (LIST DPENDANCIES) TO SEARCH .so FILES OVER COMMANDS

# ldd /usr/bin/ls TO CHECK DEPENDANCIES (.so) OF ls COMMAND

# which ls IT SHOWS COMMANDS LOCATION

ldd COMMAND IS USED TO SEARCH .so FILES

OPT
/opt (OPTIONAL) 3RD PARTY SOFTWARES ARE INSTALLED HERE
USR
/usr ALL SOFTWARES ARE INSTALLED HERE

HOME
/home USER’S HOME DIRECTORY IS STORED HERE
Eg. USER RAMU’S HOME DIRECTORY /home/ramu
 ROOT’S HOME DIRECTORY /root
PROC
/proc ALL RAM FILES ARE STORED IN /proc
AS SOON AS SYSTEM IS HUT DOWN /proc WILL BE EMPTY
ALL KERNEL PROCESS ARE ALSO STORED IN /proc
DEV
/dev IT CONTAINS ALL DEVICE DRIVERS
DEVICE DRIVERS ARE LOW LEVEL PROGRAMS THAT COMMUNICATES BETWEEN HARDWARE AND
RESPECTIVE SOFTWARE
EVERY DRIVER WILL HAVE MAJOR AND MINOR NO.
KERNEL USES THESE NOS TO IDENTIFY THE DRIVERS
ALL FILES UNDER /dev DOES NOT HAVE SIZE
AS IT DOES NOT HAVE SIZE IT IS NOT STORED IN HDD. IT IS STORED IN RAM
/dev/proc/sys FILES IN THIS FOLDER HAS NO SIZE
UDEV (UNIVERSAL DEVICE) USES RULES TO INITIALIZE DRIVERS AND LOAD IT IN RAM
ALL RULES ARE STORED IN /etc/udev/rules.d
FILES OF FILE TYPE b , s , p , c ARE CALLED SPECIAL FILES
b (BLOCK) BLOCK LEVEL DATA IS STORED (HDD, PENDRIVE)
HDD WILL BE OF b FILE TYPE. IT IS USED TO COMMUNICATE WITH SROAGE BLOCKS
c (CHARACTER) CHARACTER FILES ARE USED TO READ / WRITE DATA IN
CHARACTER BY CHARACTER FASHION
s (SOCKET) USED BY PERIPHERAL HARDWARE (MOUSE, JOYSTICK)
p (PIP) APP SHARE MEMORY WITH EACH OTHER WITH HELP OF PIPE
DRIVERS
HOW TO FIND ALL BLOCK FILES FROM /dev
# ls -l /dev/* | grep ^ b (^ BEGINNING AND $ END)
IT’LL SEARCH FOR LETTER b AT THE BEGINNING OF THE OUTPUT
TO VIEW RECURSIVE DIRECTORIES IN /etc
# ls -lR /etc/* | grep ^ d | wc -l
IT’LL SHOW COUNT OF ALL DIRECTORIES AND SUB DIRECTORIES
WE CAN DO LOG ROTATION USING LOG ROTATE SERVICE
/dev/lp0 PRINTER DRIVER
/dev/nst0 TAPE DEVICE DRIVER
/dev/loop0 TO MOUNT ISO. IF WE DOWNLOAD ISO ON A LINUX
SYSTEM AND WANT TO MOUNT IT
# mount -o loop <ISO file> /mnt
MNT
/mnt IT IS OPTONAL. IT IS USED FOR TEMPORARY MOUNTING
TMP
/tmp IT CONTAINS TEMPORARY FILES. IT CONTAINS LOCK FILES
(.lck FILES).
FOR Eg. WHEN WE PLAY A SONG IN VLC PLAYER, WE CANNOT PLAY THE SAME SONG
SIMULTAEOUSLY. VLC CREATES A .lck FILE AND AUTOMATICALLY DELETES THE FILE ONCE THE
SONG IS OVER.
/tmp HAS STICKY BIT PERMISSION
BOOT
/boot KERNEL FILES ARE STORED HERE
Vmlinuz-3.10.0-693.el7.x86_64 IS THE KERNEL FILE
KERNEL FILE IS DEVELOPED IN C / C++ AND COMPILED IN BINARY.
THE FILE IS COMPRESSED IN .bzip FORMAT
NEXT IMPORTANT FOLDER IN /boot IS /boot/grub. IT HAS BOOT LOADER FILES LILO AND
GRUB
# du -sh DISK USAGE (s – SUMMARIZE , h – HUMAN READABLE)
du SHOWS SPACE ALLOCATED FOR A FILE ON HDD
# echo $$ SHOWS PID OF CURRENT TERMINAL
WE CANNOT CREATE FOLLOWING AS SEPARATE PARTITIONS:
/etc , /dev , /bin , /sbin , /lib
THESE DIRECTORIES CONTAIN CRITICAL SYSTEM FILES WHICH SHOULD ALWAYS BE AVAILABLE
FOR OS TO RUN . IF WE CREATE THEM AS PARTITIONS, THERE ARE CHANCES THEY CAN GET
UNMOUNTED. IN THIS CASE THE OS WILL NOT LOAD.
WHENEVER RUNNING ANY COMMAND IN THE TERMINAL, stdin , stdout AND stderr ARE THREE
DATA STREAMS THAT BASH CREATES.
ESSENTIALLY THEY ALLOW PIPING / REDIRECTING DATA FROM ONE COMMAND TO ANOTHER
IN COMPUTING, THE TERM STREAM REFERS TO SOMETHING THAT CAN TRANSFER DATA. HENCE,
ALL THREE STREAMS CARRY TEXT AS DATA
stdin STANDARD INPUT. IT TAKES TEXT AS INPUT
stdout STANDARD OUTPUT. TEXT OUTPUT OF A COMMAND IS
STORED IN stdout STREAM
stderr STANDARD ERROR. WHENEVER A COMMAND FACES AN
ERROR, ERROR MESSAGE IS STORED IN stderr
EACH FILES ASSOCAITED WITH A PROCESS IS ALLOCATED A UNIQUE NUMBER TO IDENTIFY IT.
THIS IS KNOWN AS THE FILES DESCRIPTOR. WHENEVER AN ACTION IS REQURIED TO BE
PERFORMED ON A FILE, THE FILE DESCRIPTOR IS USED TO IDENTIFY THE FILE

0 : stdin
1 : stdout
2 : stderr