Finding files and where they belong

find walks, locate looks it up

find walks the tree now, so it is always current and always slower: find /home -name "*.conf" -type f, with tests for size (-size +100M), age (-mtime -7), owner (-user) and permission (-perm). -exec runs a command on each result, terminated by \; for one at a time or + to batch them, and piping to xargs is the alternative. Quote the pattern or the shell expands it first.

locate answers instantly because it reads a database rather than the filesystem — which means it can be wrong in both directions, listing files that have been deleted and missing ones created since the database was built. updatedb rebuilds it, normally from a nightly job, and /etc/updatedb.conf decides what that rebuild covers: PRUNEPATHS lists directories to leave out, PRUNEFS lists filesystem types to leave out so that network and virtual filesystems are never walked, and PRUNENAMES lists directory names to skip wherever they appear. That file is why locate can know nothing about /tmp or an NFS mount immediately after a rebuild — a miss with nothing to do with the database being stale, and the one a question sets up when it says the database was refreshed a minute ago. whereis finds the binary, source and manual page for a command; which and type answer what the shell would run.

The hierarchy, and the reasoning behind it

The FHS sorts directories by two questions: shareable or not, and static or variable. /bin and /sbin hold commands needed before other filesystems are mounted — /sbin for the ones intended for administrators — while /usr/bin and /usr/sbin hold everything else. /lib holds the libraries those early commands need. /etc is configuration, always local to the machine and never shared.

/var is for data that changes, and its subdirectories divide by how long that data is meant to last: /var/log for logs, /var/spool for work queued and waiting to be processed, /var/cache for anything that can be regenerated, /var/lib for application state that must persist. Runtime data describing the machine only since it was last booted moved out of /var/run to a top-level /run, precisely because /var may be a separate filesystem mounted too late for early boot; /run is a tmpfs, so the PID files and sockets a daemon puts there are gone after a restart, which is the whole point of them. /tmp is scratch space that may be cleared on reboot, /var/tmp scratch space that should survive one.

The rest of the tree divides by who owns what is in it. The distribution owns /bin, /sbin, /usr/bin and /usr/sbin; the local administrator owns /usr/local, which mirrors the same structure one level down — /usr/local/bin, /usr/local/sbin, /usr/local/lib, /usr/local/share — so a utility built from source belongs in /usr/local/bin, where no package upgrade can collide with it. /opt is for a third-party package that keeps its own self-contained tree under /opt/<package>, and /srv for data this machine serves. /home is user directories, /root is the superuser's own, and /boot holds the kernel. /proc, /sys and /dev are kernel interfaces rather than storage, and /media and /mnt are where removable and temporary filesystems get attached.