Skip to main content

Command Palette

Search for a command to run...

Linux File System Hunting

Updated
6 min read
Linux File System Hunting

Understanding Linux Like a Backend Engineer:

Imagine building the world’s fastest Formula 1 car, your web app, but having no idea how the engine, fuel lines, or electrical systems work.

That’s what backend development can feel like when you deploy code without understanding Linux.

In production, servers don’t have fancy desktop interfaces. They are minimal Linux machines. And when your Node.js app crashes at 3:00 AM, npm start won’t save you.

You need to understand:

• How the operating system handles network traffic
• How processes are managed
• How environment variables work
• How services start and stop

This isn’t about memorizing commands.

It’s about understanding the blueprint of modern backend infrastructure.

The Core Idea: “Everything is a File”

One of Linux’s most powerful ideas is:

Everything is a file.

In Linux, hardware devices, network sockets, running processes, and system settings are all represented as files inside the filesystem.

This design makes Linux consistent and predictable.

Important Terms

VFS (Virtual File System)

An abstraction layer that lets Linux treat completely different resources like hard drives, process memory, and network sockets the same way.

Inodes

Metadata containers for files.

They store:

• Permissions
• Owner
• File size
• Timestamps

But not the filename or actual file content.

Pseudo Filesystems

Special filesystems like /proc and /sys that don’t exist on disk.

They are generated dynamically in RAM by the Linux kernel.

5 Important Linux Discoveries

These are some of the most useful places to explore.

1. The Kernel’s Brain /proc

What it is

A pseudo filesystem that exposes live kernel and process information.

Why it exists

It gives users and programs real time access to system internals.

What to explore

/proc/cpuinfo → CPU details
/proc/meminfo → Memory stats
/proc/loadavg → System load
/proc/net/tcp → Active TCP connections

Why it matters

When your app listens on port 3000, Linux records that connection here.

This means your web server literally shows up as a file entry.

Insight:
Tools like top, ps, and monitoring systems depend heavily on /proc.

2. The Identity Matrix /etc/passwd and /etc/shadow

What it is

Linux user account databases.

Why it exists

Linux needs to know:

• Who you are
• What permissions you have
• How authentication works

What to explore

Inside /etc/passwd, you’ll see usernames and metadata.

Example:

john:x:1000:1000:John Doe:/home/john:/bin/bash

Notice the x?

That means the real password hash is stored in /etc/shadow.

Why it matters

This separation improves security.

Normal processes can map usernames to IDs without touching password hashes.

Insight:

This is an early example of security boundary design.

3. The Internet’s Address Book /etc/resolv.conf

What it is

DNS resolver configuration.

Why it exists

Humans use domains like google.com. Machines need IP addresses.

This file tells Linux where to ask for DNS resolution.

What to explore

Example:

nameserver 8.8.8.8
nameserver 1.1.1.1

Why it matters

If your API requests fail, DNS might be broken, not your code.

Insight:

A bad DNS config can make your entire backend feel offline.

4. The System Heartbeat /var/log

What it is

The main storage area for logs.

Important files

/var/log/syslog
/var/log/auth.log

Why it exists

Everything important leaves traces here:

• Errors
• Crashes
• Login attempts
• Security events

What to explore

In auth.log, you may see failed SSH attempts from bots.

Why it matters

Debugging is mostly reading logs.

Insight:
Production engineers spend more time reading logs than writing code.

5. Hardware as Text /dev/null and /dev/urandom

What they are

Special device files.

/dev/null

A black hole.

Anything written here disappears.

Example:

echo "hello" > /dev/null

Output is gone forever.

/dev/urandom

A cryptographically secure random number generator.

Used for:

• Tokens

• Session IDs

• API keys

Why it matters

Backend developers constantly use /dev/null to silence noisy processes.

Example:

npm start > /dev/null 2>&1

Insight:

Linux treats virtual devices like normal files.

Linux File System Map

       [ / ] Root
         │
         ├── [ etc ]  → Config files
         │      ├── resolv.conf
         │      └── passwd
         │
         ├── [ proc ] → Kernel & process info
         │      └── net/tcp
         │
         ├── [ dev ]  → Device files
         │      ├── null
         │      └── urandom
         │
         └── [ var ]  → Logs and variable data
                └── log/syslog

This structure shows how Linux organizes system logic under one root.

Connecting Linux to Web Development (JavaScript Examples)

Example 1: Reading Kernel Data with Node.js (/proc)

Node.js can directly read Linux system data.

import fs from 'fs';

function getSystemLoad() {
    try {
        const loadAvg = fs.readFileSync('/proc/loadavg', 'utf8');
        const [oneMin, fiveMin, fifteenMin] = loadAvg.split(' ');

        console.log(`🚀 1 Minute Load: ${oneMin}`);
        console.log(`📊 5 Minute Load: ${fiveMin}`);
    } catch (error) {
        console.error("Not running on Linux!", error.message);
    }
}

getSystemLoad();

Why this matters

Monitoring tools often read /proc behind the scenes.

Your application metrics may depend on this exact file.

Example 2: Silencing Background Jobs with /dev/null

Sometimes background tasks generate useless logs.

You can discard them.

import { spawn } from 'child_process';
import fs from 'fs';

const discard = fs.openSync('/dev/null', 'w');

const job = spawn('npm', ['run', 'build'], {
    stdio: ['ignore', discard, discard]
});

console.log("Background job started silently.");

Why this matters

This keeps logs clean and reduces clutter.

Very useful in production automation.

Key Takeaways

1. Linux Turns Concepts into Paths

Processes, devices, and networking are exposed like files.

This makes the system transparent.

2. Security is Built Through Separation

Files like /etc/passwd and /etc/shadow show how Linux separates public and private data.

3. Logs Are Everything

If your app breaks, logs are your first source of truth.

4. Backend Developers Need Linux

Your code does not run in isolation.

It runs on top of:

• Kernel processes
• File permissions
• DNS configs
• Network sockets
• System logs

Understanding Linux turns your server from a black box into something predictable and debuggable.

And that’s what makes you a stronger backend engineer.

In closing

I hope that you’ve found this blog on “Linux File System Hunting” helpful...!

That's all for today! 😁 You reached the end of the article 😍.

Want more..?

I write articles on princekumar-engineer.hashnode.dev, and also post development-related content on the following platforms: