With the environment set up in the previous lesson — Bash 5.x, your ~/veloz-ops created and the PATH configured — the time has come to move around the system with confidence. Navigating the command line is not a formality: it is the skill that everything else rests on. When, in Module 9, your script has to locate /var/log/veloz/access.log from any directory, or when at three in the morning you have to work out what is filling up the disk on srv-veloz-01, it will all come down to moving and looking with precision. In this lesson you will learn the anatomy of a command, the map of the Linux filesystem and the tools to walk and inspect it.

1. Anatomy of the prompt and of a command
2. The Linux directory tree
3. Absolute and relative paths
4. pwd: where am I
5. cd: moving around
6. ls: looking
7. Reading the output of ls -l
8. tree: seeing the structure at a glance
9. pushd and popd: the directory stack
10. Inspecting without opening: file, stat, du and df
11. A guided tour of the Veloz Envíos infrastructure

The prompt is the line Bash prints while waiting for your orders. With the configuration we left in the previous lesson it looks like this:

Every piece tells you something:

That last character deserves attention: # means you have full permissions and that a mistake can be irreversible. Get into the habit of looking at it before running anything destructive.

A Bash command breaks down like this:

• Command: the program to run (ls).
• Options (or flags): they change the behavior. They start with a dash.
• Arguments: what the command acts on.

Options come in two formats worth telling apart:

These four forms are equivalent:

A practical rule: use short options when typing interactively and long ones when writing scripts. In a script, --human-readable explains itself; -h forces you to check the manual (and in many other commands -h means "help", which is misleading).

When a long option takes a value, it is written with = or with a space:

And one detail that saves odd situations: -- marks the end of the options. If one day you have a file called -report.txt, ls -- -report.txt treats it as an argument and not as an option.

In Linux there are no drive letters. Everything hangs from a single origin: the root, /. Additional disks, USB drives or network partitions are "mounted" at some point in that tree.

The directories you will use daily:

This layout is not arbitrary: it is defined by the FHS (Filesystem Hierarchy Standard). Knowing it lets you guess where things are on any Linux server, even one you have never seen. If someone tells you "check the application logs", you already know you will start by looking in /var/log.

A path is the address of a file or directory. There are two ways of expressing it.

• Absolute path: it starts with / and describes the full route from the root. It is unambiguous and works from anywhere.

  /var/log/veloz/access.log
  

• Relative path: it does not start with / and is interpreted from the current directory.

  veloz/access.log     (if you are in /var/log)
  

Bash also understands four fundamental shortcuts:

Examples with the current directory set to /var/log/veloz:

When should you use each? The professional rule is clear:

• In scripts, absolute paths. A veloz-ops script launched by cron may start from any directory; if it uses relative paths, it will fail unpredictably.
• Interactively, relative ones. You type far less.

The - shortcut deserves a special mention because it saves an enormous amount of time:

cd - takes you back to the previous directory and also prints where it went. Switching between two distant locations becomes a single keystroke.

pwd (print working directory) answers the most basic question.

It looks unnecessary if the prompt already shows it, but it is not: some prompts only display the directory's short name (\W instead of \w), and in a script there is no prompt at all.

It has an interesting nuance with symbolic links:

-P (physical) shows the real path, resolving symbolic links. By default, pwd shows the logical path, that is, the route you took to get there. If /srv/veloz/data were actually a link to /mnt/veloz-data, pwd would say the former and pwd -P the latter. When diagnosing disk space, that difference matters.

cd (change directory) changes the current directory. Its most useful forms:

A realiztic working sequence on srv-veloz-01:

Notice the detail: cd ../.. from /var/log/veloz goes up two levels and lands in /var, not in the root. Each .. steps back exactly one rung.

An important technical note that will fully make sense in the next lesson: cd is not a program, it is a Bash builtin. It has to be. If it were an external executable, it would launch as a child process, change its directory and die, leaving yours untouched. That is why man cd finds nothing and you have to use help cd; we will see this in 01-05.

Tab completion, which is essential here: type cd /var/log/vel and press Tab. Bash completes it to /var/log/veloz/. If several options are possible, press Tab twice to list them. The full set of keyboard shortcuts appears in 02-06, but start using this one today: it cuts down typing errors dramatically.

ls lists the contents of a directory. It is probably the command you will run the most times in your life.

With no arguments, it lists the current directory. You can point it at another one:

The combinations that will become reflexes:

Sorted by date: the first one is the most recently modified. This is the star command when something has just broken: it immediately tells you which log is being written right now.

Sorted by size from largest to smallest: the star command when the disk fills up.

A key concept shows up here: in Linux, a file is hidden simply because its name starts with a dot. There is no special attribute. That is why ~/.bashrc does not appear with a plain ls. The . and .. directories you see are the directory itself and its parent.

This is one of those skills used daily throughout an entire professional career. Take one line:

It breaks down into seven fields:

The first field is read in four blocks:

The first character indicates the type:

The next three blocks are permissions: r read, w write, x execute; a dash means that permission is not granted. So -rw-r--r-- reads as: regular file, the owner can read and write, the group can only read, everyone else can only read.

This analysis immediately explains practical things. If you try to write to /var/log/veloz/app.log as joan and the file belongs to veloz with -rw-r--r-- permissions, you will get Permission denied. And if a script of yours will not start with ./script.sh, the first thing you will check is whether it has the x. Permissions, how to change them and octal notation are studied in depth in lesson 02-03; here you only need to know how to read them.

A special case you will see a lot on a server:

The leading l and the -> arrow indicate a symbolic link: a file that points to another. The rwxrwxrwx permissions of a link are always like that and mean nothing; the ones that matter are the target's.

tree draws the directory hierarchy. It is not installed by default on many systems:

Useful options:

Limiting the depth with -L is almost mandatory in large directories: without it, tree / can spit out hundreds of thousands of lines.

If tree is not available and you cannot install it (common on production servers or in containers), the alternative is ls -R, which we will see in the final tour, or find combined with a format, which is covered in 05-01.

cd - toggles between two directories, but sometimes you need to juggle three or four. For that, Bash maintains a directory stack.

• pushd PATH: pushes the current directory onto the stack and moves to PATH.
• popd: pops the stack and returns to the directory at the top.
• dirs -v: shows the stack, numbered.

Each pushd prints the whole stack, with the current position on the left. It is the ideal tool when you are diagnosing an incident and need to jump between logs, data and scripts without losing your thread. You can also jump straight to a position: pushd +2 rotates the stack to item number 2.

Before opening a file it pays to know what it is and how much space it takes. Four commands cover 90% of the cases.

Linux does not trust the extension: file examines the contents to determine the type.

Its practical value is enormous: it stops you from opening a 2 GB binary in a text editor and freezing the terminal. Before running cat on an unknown file, run file on it.

A very relevant use for Veloz Envíos: spotting compressed files with a misleading extension.

Even though it does not end in .gz, it is compressed, and it would have to be read with zcat instead of cat.

stat gives you the same as ls -l but with full precision, including the three timestamps Linux maintains:

Confusing mtime with ctime is a common mistake in audits: if someone changed a file's permissions but not its contents, mtime stays the same and only ctime gives it away.

stat also accepts custom formats, very handy in scripts:

Where %n is the name, %s the size and %y the modification date. In Module 9 we will use this form to check whether a log has been updated recently.

du (disk usage) adds up the space used.

• -s (summarize): a single total instead of the detail of every subdirectory.
• -h (human-readable): in K, M, G.

To see the breakdown per subdirectory, sorted from largest to smallest:

This command is the standard answer to "the disk is filling up": it tells you which subdirectory the problem is in, and by repeating it one level down you reach the culprit in a few steps. The | pipe and sort are studied in Module 2; here we are using it as a recipe.

df (disk free) reports the mounted partitions and how full they are.

The difference between the two commands tends to confuse:

And a classic anomaly worth knowing: if df says the disk is full but du cannot find the data, it is almost always because a process is keeping an already deleted file open. The space is not released until that process ends. That is exactly what happens when someone deletes access.log without restarting the service that writes to it. Process management is covered in 05-02.

df -i is also worth knowing: it shows the free inodes. A disk with space but no available inodes (millions of tiny files) also produces "no space left" errors.

Let us put it all together in a real reconnaissance session on srv-veloz-01. It is your first day and you want to understand the terrain.

You already know a lot from this single screen:

• app.log and access.log are being written right now (today's date, a recent time): the service is alive.
• The .1 files are the previous day's rotations, cut off at 23:59.
• access.log weighs 28 MB, four times more than app.log: if space needs watching, that is the candidate.
• access.log belongs to www-data and app.log to veloz: they are two different services, with different identities. As joan, you will be able to read them (the "others" block has r) but not write to them.

Confirmed: the rotated file is compressed despite not ending in .gz. Good to know before trying to read it.

A working pattern is visible: there is an active file, a monthly one and an archive directory. The 06:00 timestamp suggests an automated process that runs in the early hours.

/srv at 87%: not critical yet, but exactly the kind of metric our future report script should watch. Make a mental note, because it will be one of the requirements in Module 9.

For now it is empty. From Module 3 onwards we will start filling it.

If tree is not installed on the server:

Less pretty, but available on any machine.

• Confusing /var/log with ~/veloz-ops/logs. The first is managed by the system and requires permissions; the second is yours. Our scripts will write to the second.
• Running cd without checking whether it worked. If the directory does not exist, cd fails but you stay where you were; in a script, the following commands will act on the wrong directory. It is solved with cd /path || exit, which we will see in 03-04.
• Using relative paths in scripts. A script launched by cron does not start in the directory you imagine. Always absolute paths.
• Forgetting that -h does not mean the same thing in every command. In ls, du and df it is "human readable"; in many others it is "help". When in doubt, man (lesson 01-05).
• Running cat on a huge or binary file. It freezes the terminal and can leave it full of corrupted characters (fixed with reset). Use file first and less to read.
• Looking for hidden files with a plain ls. In Linux a leading dot is all it takes to hide a file. Use ls -a when something "does not show up".
• Running tree / or du / with no limit. It takes forever and floods the terminal. Use -L or --max-depth.
• Tip: use tab completion systematically. On top of typing less, it validates that the path exists while you write it: if it does not complete, you have made a mistake.
• Tip: ls -lt and du -h --max-depth=1 | sort -hr are the two diagnostic commands that most often save a night shift. Memorise them.

You are in /var/log/veloz. Without running anything, state which absolute path each expression is equivalent to:

1. ..
2. ../../..
3. ./app.log
4. ../nginx/error.log
5. ~/veloz-ops/bin
6. ../../../srv/veloz/data/shipments.csv

On your own machine (adapting the paths if you do not have the Veloz Envíos structure), carry out this reconnaissance sequence and explain what each result tells you:

1. Find out your current directory.
2. List /var/log in long format, with human-readable sizes and sorted by modification date, newest first.
3. Identify the largest file or directory in /var/log.
4. Find out the usage percentage of the partition where /var lives.
5. Determine the type of the file /etc/passwd without opening it.

Using only pushd, popd and dirs, write the sequence of commands that:

1. Starting from ~, visits /var/log, then /etc and then /tmp, pushing each one.
2. Shows the numbered stack.
3. Returns to /etc by undoing a single level.
4. Finally goes back to ~.

State which directory you end up in after each step.

Solution to Exercise 1

A detail about the third case: / is the ceiling. cd ../../../../.. from anywhere leaves you in /, with no error.

Solution to Exercise 2

Output and reading of each point:

You are in your home folder.

The first entry is the most recently modified: the services writing right now. It is the starting point for investigating an ongoing incident.

The first line is the total of the directory you asked about; from there on, veloz is the biggest consumer. Note: --max-depth=1 includes the directory itself, which is why /var/log heads the list.

/var has no partition of its own: it hangs off /, which is at 76%. That is an important fact, because it means a runaway log can fill the entire system, not just /var.

It is plain text, so it can be read with cat or less with no risk. Despite the name, it does not contain passwords (those are in /etc/shadow).

Solution to Exercise 3

Output of dirs -v at step 2:

The route: ~ → /var/log → /etc → /tmp → (popd) /etc → (popd) /var/log → (popd) ~.

Notice that each pushd pushes the directory you were in and takes you to the new one, while popd discards the top and places you in the next. An alternative for the last step would be cd ~ directly, but the exercise asked for the stack only. If you wanted to jump straight to /var/log from /tmp without popping, pushd +2 would rotate the stack to that position.

You now move around the system with judgement. You can break a command down into program, options and arguments; you know the FHS map and what each key directory holds; you tell absolute from relative paths and know when to use each; you handle pwd, cd, ls with their decisive options, tree and the pushd/popd stack; and you can read ls -l line by line and inspect files with file, stat, du and df before touching them. Above all, you have done your first real reconnaissance of srv-veloz-01 and you now know where every piece of Veloz Envíos lives.

So far you have been using the shell. In the next lesson, Understanding the Shell, we will open the box: what exactly happens between pressing Enter and the result appearing, why cd cannot be an external program, how Bash looks for commands in the PATH, what a subshell is and why a variable defined inside one disappears when you leave it. Understanding that mechanism is what separates someone who copies commands from someone who knows what they are doing.