Uninstalling the Wazuh agent

This section describes how to uninstall Wazuh agents installed across the different operating systems below:

Uninstalling a Linux Wazuh agent

Note

To uninstall Wazuh agent from a Linux endpoint with the anti-tampering feature enabled, refer to Uninstalling an agent with anti-tampering enabled.

Run the following commands to uninstall a Linux agent.

  1. Remove the Wazuh agent installation.

    # apt-get remove wazuh-agent

    Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Run the following command If you want to remove all files completely.

    # apt-get remove --purge wazuh-agent

  2. Disable the Wazuh agent service.

    # systemctl disable wazuh-agent
# systemctl daemon-reload

The Wazuh agent is now completely removed from your Linux endpoint.

Uninstalling a Windows Wazuh agent

To uninstall the agent, the original Windows installer file is required to perform the unattended process:

msiexec.exe /x wazuh-agent-4.12.0-1.msi /qn

The Wazuh agent is now completely removed from your Windows endpoint.

Uninstalling a macOS Wazuh agent

Follow these steps to uninstall the Wazuh agent from your macOS endpoint.

  1. Stop the Wazuh agent service.

    # launchctl bootout system /Library/LaunchDaemons/com.wazuh.agent.plist

  2. Remove the /Library/Ossec/ folder.

    # /bin/rm -r /Library/Ossec

  3. Remove launchdaemons and StartupItems.

    # /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
# /bin/rm -rf /Library/StartupItems/WAZUH

  4. Remove the Wazuh user and group.

    # /usr/bin/dscl . -delete "/Users/wazuh"
# /usr/bin/dscl . -delete "/Groups/wazuh"

  5. Remove from pkgutil.

    # /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent

The Wazuh agent is now completely removed from your macOS endpoint.

Uninstalling a Solaris Wazuh agent

Select the Solaris version you want to uninstall.

Run the following command to uninstall the Wazuh agent in Solaris 10.

# pkgrm wazuh-agent

The Wazuh agent is now completely removed from your Solaris endpoint.

Uninstalling an AIX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the AIX endpoint.

# rpm -e wazuh-agent

Some files are not removed from the filesystem by the package manager. Delete the /var/ossec/ folder if you want to remove all files completely.

The Wazuh agent is now completely removed from your AIX system

Uninstalling an HP-UX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the HP-UX endpoint.

  1. Stop the Wazuh agent service.

    # /var/ossec/bin/wazuh-control stop

  2. Delete wazuh user and group:

    # groupdel wazuh
# userdel wazuh

  3. Remove Wazuh files.

    # rm -rf /var/ossec

The Wazuh agent is now completely removed from your HP-UX endpoint.