If you’ve just started managing a Linux server, the commands make more sense once you know what’s happening underneath. This is a short tour of the main parts of a Linux system and how they fit together.

The layers

Applications (nginx, mysql, your app)
        │  system calls
Kernel (processes, memory, files, network, drivers)
        │
Hardware (or virtual hardware on a VPS)

Programs never touch hardware directly. They ask the kernel through system calls: open a file, allocate memory, send network data. The kernel decides, enforces permissions and talks to the hardware.

The kernel

The kernel’s main jobs:

  • Process scheduling — sharing CPU time between running programs.
  • Memory management — giving each process its own virtual memory, caching files, swapping.
  • Filesystems — turning disk blocks into files and directories.
  • Networking — the TCP/IP stack, firewall (netfilter) and routing.
  • Device drivers — disks, network cards, virtual devices.
uname -r                 # running kernel version
lsmod | head             # loaded kernel modules (drivers)
dmesg | tail             # recent kernel messages

On a KVM VPS your server runs its own kernel, just like a physical machine. (Container-based virtualization shares one kernel between customers.)

The shell

The shell (usually Bash) reads your commands and runs programs. When you type ls -l /etc, Bash:

  1. Finds ls in the directories listed in $PATH.
  2. Creates a new process (fork) and runs the program in it (exec).
  3. Waits for it to finish and stores its exit status in $? (0 = success).

Pipes connect programs: journalctl -u nginx | grep error | wc -l sends one program’s output into the next.

Processes

Every running program is a process with a PID, an owner, and a parent.

ps aux --sort=-%cpu | head      # top CPU users
pstree -p | head                # parent/child tree
top                             # live view (or htop)

Processes communicate with signals: kill -TERM 1234 asks a process to stop cleanly; kill -KILL 1234 forces it. Services usually reload configuration on HUP.

systemd: starting and supervising services

PID 1 on most distributions is systemd. It starts services at boot, restarts them if they crash and collects their logs.

systemctl status nginx
systemctl restart nginx
systemctl enable nginx          # start at boot
journalctl -u nginx --since "1 hour ago"

Everything is a file

Linux presents most things as files:

Path Contains
/etc Configuration
/var/log Logs (plus the systemd journal)
/var/lib Application data (databases, Docker)
/home, /root User home directories
/usr/bin, /usr/sbin Programs
/tmp Temporary files
/proc, /sys Virtual files exposing kernel and process information
/dev Devices (disks like /dev/vda)

For example, cat /proc/meminfo asks the kernel for memory statistics, and cat /proc/1234/status shows details of process 1234.

Users and permissions

Each file has an owner, a group and permissions (read/write/execute for owner, group, others). The root user can do anything, which is why you should work as a normal user with sudo. See user and permission management.

Memory

Linux uses free RAM to cache files, so “free” memory is usually low — look at available in free -h instead. Details in Linux file system caching.

Where to look when something breaks

  1. systemctl status <service> and journalctl -u <service>
  2. journalctl -p err -b — all errors since boot
  3. df -h — full disks cause many strange errors
  4. free -h, top — memory and CPU
  5. ss -tulpn — what’s listening on which port

Keep learning

Practice is the fastest teacher. A small Ubuntu VPS or Debian VPS is a safe place to experiment — reinstall from the control panel if you break it. Next, read SSH into your VPS and customizing your Bash prompt.

  • Linux
  • Beginners