Summary: How to work with symbolic and hard links on Red Hat.
Date: Around 2014
Refactor: 29 March 2025: Checked links and formatting.

There are two type of links, symbolic links and hard links. This page is all about inodes actually, if you need more information about inodes check inode or read on.

Symbolic links are links to a filename, as a real shortcut. They can point to filenames in another fileystem, something that hardlinks cannot.

To create a symbolic link to example the /etc/passwd file:

ln -s /etc/passwd symlinkfile

If you find it hard to remember what goes first just think about the cp command. Always start with the original file.

If you delete a symbolic links nothing really happens to the data the symbolic link pointed to. It's really just a shortcut. If you would delete the file it pointed to the symbolic links still exists but it is broken. If you would look at it from a modern shell (as is the default on red hat) you would see it in red so it's really clear the symbolic link is broken.

Hard links are links to the inode, so it represents the real data. To create a hard link to the data behind the /etc/passwd file:

ln /etc/passwd hardlinkfile

As long as there is more than 1 reference to an inode you can delete hardlinks without deleting the inode and the associated datablocks. Only after you remove the last reference the inode and the datablocks get deleted.

Inode information can be seen using the “ls -il” command:

[root@kick ~]# ln -s /etc/passwd symlinkfile
[root@kick ~]# ln /etc/passwd hardlinkfile
[root@kick ~]# ls -il /etc/passwd symlinkfile hardlinkfile
395621 -rw-r--r--. 2 root root 1058 Mar 17 21:59 /etc/passwd
395621 -rw-r--r--. 2 root root 1058 Mar 17 21:59 hardlinkfile
  9988 lrwxrwxrwx. 1 root root   11 Mar 17 22:31 symlinkfile -> /etc/passwd

As you can see share the passwd and hardlinkfile the same inode number and have a count of 2, that are the number of references to the inode number.

Since all directories have a shortcut inside the directory to itself (.) they always have a inode count of 2. If they have a subdirectory, this one has a (.) but also a (..) shortcut pointing to the directory above it, which means the parent directory will have a inode count of 3. This shows nice in the root directory:

[root@kick /]# ls -l
total 90
dr-xr-xr-x.   2 root root  4096 Mar 17 21:58 bin
dr-xr-xr-x.   5 root root  1024 Mar 17 22:00 boot
drwxr-xr-x.  18 root root  3720 Mar 17 22:00 dev
drwxr-xr-x.  81 root root  4096 Mar 17 22:00 etc
drwxr-xr-x.   2 root root  4096 Jun 28  2011 home
dr-xr-xr-x.  10 root root  4096 Mar 17 21:58 lib
dr-xr-xr-x.   9 root root 12288 Mar 17 21:58 lib64
drwx------.   2 root root 16384 Mar 17 21:54 lost+found
drwxr-xr-x.   2 root root  4096 Jun 28  2011 media
drwxr-xr-x.   2 root root  4096 Jun 28  2011 mnt
drwxr-xr-x.   3 root root  4096 Mar 17 21:58 opt
dr-xr-xr-x. 129 root root     0 Mar 17  2014 proc
dr-xr-x---.   3 root root  4096 Mar 17 22:31 root
dr-xr-xr-x.   2 root root 12288 Mar 17 21:58 sbin
drwxr-xr-x.   7 root root     0 Mar 17  2014 selinux
drwxr-xr-x.   2 root root  4096 Jun 28  2011 srv
drwxr-xr-x.  13 root root     0 Mar 17  2014 sys
drwxrwxrwt.   3 root root  4096 Mar 17 22:15 tmp
drwxr-xr-x.  13 root root  4096 Mar 17 21:55 usr
drwxr-xr-x.  20 root root  4096 Mar 17 21:58 var

As you can see, some of the directories have lot of subdirectories.

You can also look at the actual inode with stat:

[root@kick /]# stat /etc/passwd
  File: `/etc/passwd'
  Size: 1058            Blocks: 8          IO Block: 4096   regular file
Device: 803h/2051d      Inode: 395621      Links: 2
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-03-17 22:32:01.955408624 +0100
Modify: 2014-03-17 21:59:19.724999960 +0100
Change: 2014-03-17 22:31:58.066412349 +0100

This will show you the number of links, blocks, type of file etc.