Suricata

Either way could work I guess. Any idea how other tools do this?

There is information out there that perhaps the current method is best:

http://serverfault.com/questions/197716/how-can-i-drop-privileges-and-still-clean-up-my-pid-file-in-var-run/197718#197718

That is, Suricata will clean it up if it can, otherwise not worry about. Systemd can solve this pretty easily with a pre-run, or post-stop hook that does the additional cleanup. Other init systems could adapt as needed.

A third option, is to drop the PID after dropping privileges, but right it to a "suricata" user owned directory, ie: /var/run/suricata/, where the "suricata" owned socket file is written.