PID file is small file that contains process identification number usually for daemon processes. Typically pid file location is /var/run directory or sub-directories of /var/run. In new Linux versions /var/run is symbolic link to /run directory. The PID file is created when daemon service is started and deleted when the service stops. If daemon process is terminated abnormally (crashed or killed) the service status displays that daemon is dead but pid file exists, for example: “crond dead but pid file exists”. PID file has extension pid and normally the name of PID file is the same as daemon process name:
# cat /var/run/atd.pid
# ps -aux | grep 1209
root 1209 0.0 0.0 42624 2500 ? Ss Jul15 0:00 /usr/sbin/atd -f
# pidof atd
# systemctl status atd
● atd.service – Job spooling tools
Loaded: loaded (/usr/lib/systemd/system/atd.service; enabled; vendor preset:>
Active: active (running) since Wed 2020-07-15 15:09:30 CDT; 3 months 25 days>
Main PID: 1209 (atd)
Tasks: 1 (limit: 24607)
└─1209 /usr/sbin/atd -f
However the name of PID file may be different than daemon process name.
This is example from Ubuntu VM on Oracle VirtualBax. PID file /var/run/sendsigs.omit.d/network-manager.dnsmasq.pid contains PID=18871. However pidof command cannot find PID for process network-manager.dnsmasq. The ps command shows dnsmasq process (not network-manager.dnsmasq) for PID=18871.
# cat /var/run/sendsigs.omit.d/network-manager.dnsmasq.pid
# pidof network-manager.dnsmasq
# ps -aux | grep 18871
nobody 18871 0.0 0.0 6604 1164 ? S Nov08 0:01 /usr/sbin/dnsmasq –no-resolv –keep-in-foreground –no-hosts –bind-interfaces –pid-file=/var/run/sendsigs.omit.d/network-manager.dnsmasq.pid –listen-address=127.0.0.1 –conf-file=/var/run/nm-dns-dnsmasq.conf –cache-size=0 –proxy-dnssec
Another option to find real process name by PID is stat file, located at /proc/[pid] directory, The stat file contains status information about the process including its real name.