Why are process management files on Linux stored under /var/run?

For example:

$ ls -ltr /var/run/ | grep pid
-rw-r--r--  1 root           root              4 Mar 26 14:12 lvmetad.pid
-rw-r--r--  1 root           root              5 Mar 26 14:12 auditd.pid
-rw-------  1 root           root             11 Mar 26 14:12 alsactl.pid
-rw-------  1 root           root              5 Mar 26 14:12 gssproxy.pid
-rw-r--r--  1 root           root              5 Mar 26 14:12 ksmtune.pid
-rw-r--r--  1 root           root              5 Mar 26 14:12 vmtoolsd.pid
-rw-------  1 root           root              5 Mar 26 14:13 sm-notify.pid
-rw-r--r--  1 root           root              5 Mar 26 14:13 sshd.pid
-rw-r--r--  1 root           root              5 Mar 26 14:13 rhnsd.pid
-rw-r--r--  1 root           root              5 Mar 26 14:13 atd.pid
-rw-r--r--  1 root           root              6 Mar 29 09:42 crond.pid
-rw-------  1 root           root              6 Mar 30 18:38 syslogd.pid
-rw-r--r--  1 root           root              7 Mar 30 19:39 chronyd.pid
-rw-------  1 root           root              6 Mar 30 21:52 sssd.pid
-rw-------  1 root           root              5 Mar 30 21:52 oddjobd.pid

Note that as we all know, /var/run is a tmpfs file system.

  • 2
    What part of this surprises you? Where would you expect them to be stored? Can you edit your question and clarify? – terdon May 22 at 10:47
  • Ironically, this picks the one usage of /run (out of many others) that actually should not exist, and really does not in modern systems of the past three decades, the world having known that PID files are rickety and dangerous since the 1980s and proper service management having been around since the 1990s. But as far as I can see the question is not asking why, when all of these things are under service management and the service managers don't use that rickety and dangerous mechanism, this old rubbish hasn't been removed and there are still PID files being created, tempting fate. (-: – JdeBP May 23 at 6:56

Because the /var/run is the blessed directory by FHS standard, for a software's run time data.

The /var/run directory was "deprecated", and now it is a symlink to /run on many systems.

This directory contains system information data describing the system since it was booted. Files under this directory must be cleared (removed or truncated as appropriate) at the beginning of the boot process.

Since the data there must be cleared and is typically small (PID files are small, and the other commonly stored run-time data there are UNIX sockets), it makes much sense to have it on tmpfs. A reboot will take care of clearing it.

| improve this answer | |
  • Of course, blaming the FHS only results in the question to be restated as Well, why did the FHS specify that?. It's not because the data are small, by the way. It is because the data are ephemeral. Shared memory files, Message Of The Day amalgamations, the active login session table, GNOME saved states, and so forth are not necessarily small. – JdeBP May 23 at 6:45

Filesystem Hierarchy Standard for /run specifies:

Process identifier (PID) files, which were originally placed in /etc, must be placed in /run. The naming convention for PID files is .pid. For example, the crond PID file is named /run/crond.pid.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.