Linux System Files: The Configs, the Logs, and the Live Stats
The handful of files every admin learns to read — configs, logs, and the live kernel state.
How to Read This Index
Linux's "everything is a file" philosophy means a huge amount of the system's configuration and live state lives in plain text you can open with cat or less. No special tool, no API — just a path. Once you know the map, half of "how do I check X" answers itself.
We've grouped the files by where they live, because that's how Linux itself organizes them: /etc for configuration, /var/log for logs, /proc for the kernel's live view of the running machine, /dev for device nodes. Start with the section that matches what you're trying to learn; the full alphabetical list at the bottom is for jumping straight to a known path.
1. The Live Machine State — /proc
The files under /proc are not on disk. They're a window the kernel opens into its own state, generated on the fly each time you read them. cat /proc/loadavg is the same number uptime prints — uptime just dresses it up. Once you realize this, half the monitoring tools you've ever used stop looking magical.
/proc/buddyinfo— free-memory fragmentation per zone, per order/proc/cgroups— control-group subsystems the kernel exposes/proc/cmdline— the kernel command line passed by the bootloader/proc/consoles— registered system consoles/proc/cpuinfo— processor model, cores, flags, MHz/proc/crypto— kernel crypto algorithms available/proc/devices— character and block device drivers, by major number/proc/diskstats— per-device I/O counters, the sourceiostatreads/proc/dma— registered ISA DMA channels (mostly historical)/proc/execdomains— personality / ABI translation layers/proc/fb— registered framebuffer devices/proc/filesystems— filesystem types the kernel can mount/proc/interrupts— IRQ count per CPU, per device/proc/iomem— physical memory map: what hardware sits where/proc/ioports— I/O port ranges claimed by drivers/proc/kallsyms— all kernel symbols and their addresses/proc/kcore— the kernel's physical memory as an ELF core file/proc/keys— kernel keyring contents/proc/key-users— per-user keyring usage/proc/kmsg— kernel messages, raw (whatdmesgreads)/proc/kpagecgroup— per-page cgroup ownership/proc/kpagecount— per-page reference count/proc/kpageflags— per-page status flags/proc/loadavg— the three load numbersuptimeandtopshow/proc/locks— all file locks currently held/proc/mdstat— Linux software RAID array status/proc/meminfo— total, free, cached, buffers, swap — the memory truth/proc/misc— miscellaneous registered char devices/proc/modules— loaded kernel modules and their refcount/proc/mounts— every mounted filesystem (the live viewmountreads)/proc/mtrr— Memory Type Range Registers (x86 caching hints)/proc/pagetypeinfo— page allocator detail per migrate type/proc/partitions— block devices and partitions the kernel sees/proc/self— symlink to the calling process's own/proc/<pid>dir/proc/slabinfo— kernel slab allocator counters/proc/softirqs— soft IRQ counts per CPU/proc/stat— CPU jiffies, context switches, interrupts (the sourcetopreads)/proc/swaps— active swap files and partitions/proc/sysrq-trigger— write here to fire emergency kernel actions/proc/timer-list— pending kernel timers/proc/uptime— seconds since boot, seconds spent idle/proc/version— kernel version, gcc, build date
2. System Configuration — /etc
The "where everything is configured" directory. Every daemon, every system service, every login policy keeps its config here as plain text. If you've ever wondered "how does the system know to do that?" — the answer is almost always a file under /etc.
/etc/aliases— mail aliases for the local MTA/etc/bash.bashrc— system-wide bash startup/etc/crontab— system cron jobs/etc/dhcp/dhclient.conf— DHCP client config/etc/dhcpd.conf— DHCP server config/etc/environment— system-wide environment variables/etc/exports— NFS shares exported from this host/etc/fstab— filesystems mounted at boot/etc/group— group definitions/etc/gshadow— group passwords (the shadow of/etc/group)/etc/hosts— static hostname → IP overrides, consulted before DNS/etc/inputrc— readline keybindings (the line editor bash uses)/etc/issue— banner shown before login on the local console/etc/localtime— the binary timezone file the system actually uses/etc/modules— kernel modules to autoload at boot/etc/motd— banner shown after a successful login/etc/nsswitch.conf— where to look up users, hosts, groups (files vs DNS vs LDAP)/etc/ntp.conf— NTP daemon config/etc/passwd— user accounts (without passwords)/etc/profile— system-wide login shell startup/etc/resolv.conf— DNS resolver: nameservers, search domains/etc/rsyslog.conf— rsyslog routing and filtering/etc/security/access.conf— PAM access rules: who may log in from where/etc/security/limits.conf— per-user resource limits (open files, processes, …)/etc/shadow— password hashes, locked behind root-only perms/etc/sudoers— who can sudo what — always edit withvisudo/etc/sysctl.conf— kernel tunables applied at boot/etc/syslog.conf— legacy syslog routing (pre-rsyslog)/etc/timezone— the human-readable timezone name (e.g.Europe/Berlin)
3. Logs — /var/log
Where text-file logs live. Even on a systemd box where most logs flow through journalctl, plenty of daemons still write here — auth, the kernel, login records, and anything that predates the journal.
/var/log/alternatives.log— Debian's update-alternatives history/var/log/auth.log— sshd, sudo, login — every authentication event/var/log/btmp— failed login attempts (read withlastb)/var/log/daemon.log— messages from system daemons/var/log/debug— debug-level messages from anything that asked for it/var/log/faillog— per-user failed login counters/var/log/kern.log— kernel messages (the persistent companion todmesg)/var/log/lastlog— per-user last login record (read withlastlog)/var/log/messages— the catch-all general log on RHEL-family systems/var/log/syslog— the catch-all general log on Debian-family systems/var/log/user.log— user-level messages/var/log/wtmp— login/logout history (read withlast)
4. Device Nodes — /dev
The files under /dev aren't files at all — they're handles to devices, exposed as paths so any program that can open() a file can talk to hardware. The most useful ones are the synthetic ones: a bottomless source of zeros, a stream of randomness, a black hole.
/dev/null— the bit bucket; anything written here vanishes/dev/random— high-entropy random bytes, blocks when the pool is low/dev/tty0— the current virtual console/dev/urandom— random bytes that never block; what you should almost always use/dev/video0— the first video-capture device/dev/zero— endless stream of zero bytes; useful for wiping and benchmarks
5. Other Files Worth Knowing
robots.txt— the web crawler convention; not a Linux system file but every server admin meets it
Full Alphabetical List
Every file in the knowledge base, sorted by path. If you know exactly what you're looking for, jump straight to it.
/dev/null— the bit bucket/dev/random— high-entropy random bytes/dev/tty0— the current virtual console/dev/urandom— non-blocking random bytes/dev/video0— first video-capture device/dev/zero— endless zero stream/etc/aliases— mail aliases for the local MTA/etc/bash.bashrc— system-wide bash startup/etc/crontab— system cron jobs/etc/dhcp/dhclient.conf— DHCP client config/etc/dhcpd.conf— DHCP server config/etc/environment— system-wide environment variables/etc/exports— NFS shares exported from this host/etc/fstab— filesystems mounted at boot/etc/group— group definitions/etc/gshadow— group passwords/etc/hosts— static hostname → IP overrides/etc/inputrc— readline keybindings/etc/issue— pre-login banner/etc/localtime— binary timezone file/etc/modules— kernel modules to autoload at boot/etc/motd— post-login banner/etc/nsswitch.conf— name service lookup order/etc/ntp.conf— NTP daemon config/etc/passwd— user accounts/etc/profile— system-wide login shell startup/etc/resolv.conf— DNS resolver config/etc/rsyslog.conf— rsyslog routing/etc/security/access.conf— PAM access rules/etc/security/limits.conf— per-user resource limits/etc/shadow— password hashes/etc/sudoers— sudo policy/etc/sysctl.conf— kernel tunables applied at boot/etc/syslog.conf— legacy syslog routing/etc/timezone— human-readable timezone name/proc/buddyinfo— free-memory fragmentation/proc/cgroups— control-group subsystems/proc/cmdline— kernel command line/proc/consoles— registered system consoles/proc/cpuinfo— processor model, cores, flags/proc/crypto— kernel crypto algorithms/proc/devices— character and block drivers/proc/diskstats— per-device I/O counters/proc/dma— ISA DMA channels/proc/execdomains— personality / ABI layers/proc/fb— registered framebuffers/proc/filesystems— supported filesystem types/proc/interrupts— IRQ counts per CPU/proc/iomem— physical memory map/proc/ioports— I/O port ranges/proc/kallsyms— kernel symbols and addresses/proc/kcore— kernel physical memory as ELF/proc/keys— kernel keyring/proc/key-users— per-user keyring usage/proc/kmsg— raw kernel messages/proc/kpagecgroup— per-page cgroup ownership/proc/kpagecount— per-page reference count/proc/kpageflags— per-page status flags/proc/loadavg— 1/5/15-minute load average/proc/locks— current file locks/proc/mdstat— software RAID status/proc/meminfo— memory totals, cached, buffers, swap/proc/misc— miscellaneous char devices/proc/modules— loaded kernel modules/proc/mounts— live mount table/proc/mtrr— Memory Type Range Registers/proc/pagetypeinfo— page allocator detail/proc/partitions— block devices and partitions/proc/self— current process's/proc/<pid>/proc/slabinfo— slab allocator counters/proc/softirqs— softirq counts per CPU/proc/stat— CPU jiffies, context switches, interrupts/proc/swaps— active swap files/proc/sysrq-trigger— emergency kernel actions/proc/timer-list— pending kernel timers/proc/uptime— seconds since boot, idle seconds/proc/version— kernel version stringrobots.txt— web crawler convention/var/log/alternatives.log— update-alternatives history/var/log/auth.log— authentication events/var/log/btmp— failed logins/var/log/daemon.log— system daemon messages/var/log/debug— debug-level messages/var/log/faillog— per-user failed login counters/var/log/kern.log— kernel messages/var/log/lastlog— per-user last login/var/log/messages— catch-all log (RHEL family)/var/log/syslog— catch-all log (Debian family)/var/log/user.log— user-level messages/var/log/wtmp— login/logout history
The fastest way to learn a Linux server is to actually open these files.
CleverUptime reads the same
/procand/sysfiles in the background every minute — load, memory, swap, disk usage, temperatures — and tells you in plain language what's changing and why it matters.Want to see your own server's health right now? One command, no signup, no install.