Understanding the use of /Var/Lock/Subsys on redhat systems prior to systemd.

Redhat/Centos 6 uses a upstart daemon called init, init programs has pid of 1 which sets the environment for the user, init propram after starting becomes the main parent process then executes scripts in the file /etc/rc.d/rc.sysinit then starting all other services, init command then runs /etc/inittab this file has the runlevels configured for init daemon, runlevels cab be considered as state of os.

respective runlevel files are located at /etc/rc.d/ directory, for run level 3 init looks into /etc/rc.d/rc3.d locations and starts the scripts. symliknks to services having k are killed at init start process and that with of s are started.

Init daemon then initializes /etc/rc.d/init.d/functions which is used for start, stop, kill, identifying pid of process, /Var/Lock/Subsys location is used by the init scripts, process started by the init daemon will have a file touched here at this location this behavior is specific to rpm based distributions having init daemon.

If a file is present is at location /Var/Lock/Subsys says service should be running, a custom init script or service can have many child process, multiple executables running it would be difficult to identify the exact parent process id (PID).

service command checks the PID of the service and the subsystem PID by the same name of service at location /Var/Lock/Subsys, if the process pid is not found and lock is present you will see error: exim dead but subsys locked.