samhain generates a PID file if it is run as a daemon process. You can configure the path to the PID file at compile time, either explicitely using the ./configure --with-pid-file=FILE option, or via the ./configure --prefix=PREFIX option.