What is the difference between Process: and Main PID: in the output of systemctl status?

Question

What is the difference between the Process: and Main PID: lines in the output of systemctl status on a service unit? What does the process number denote?

For example:

In the output from systemctl status sshd we see a line with Process: above the line saying Main PID:. It has a different process number than the Main PID: line. Here's one from a RHEL admin guide:

# systemctl status sshd
sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled)
   Active: active (running) since Mon 2014-09-01 09:35:17 EST; 2s ago
  Process: 6191 ExecStartPre=/usr/sbin/sshd-keygen (code=exited, status=0/SUCCESS)
 Main PID: 6194 (sshd)
   CGroup: /system.slice/sshd.service
           └─6194 /usr/sbin/sshd -D

I'm trying to understand what that process number is.

Answer 1

Main PID is the PID of the process that is started using ExecStart= options (in the example sshd). The Process: is used for any other process that might have been started by the service using ExecStartPre, ExecStartPost, ExecStopPost, etc options. (in this example, sshd-keygen has been started using the ExecStartPre= option). You can have multiple lines on Process: if there are more than one processes started by the service, other than the main process. If there is no other process involved, you will only see the Main PID value.

I admit this is not very clear in the docs for ExecStartPre but the doc for ExecStart clarifies that the main process is the one started by that option, except for Type=forking, in which case, the daemon process is considered the main process.