Uninstalling the Wazuh agent

This section describes how to uninstall Wazuh agents installed across the different operating systems below:

Uninstalling a Linux Wazuh agent

Run the following commands to uninstall a Linux agent.

  1. Remove the Wazuh agent installation.

    # yum remove wazuh-agent
    

    Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Delete the /var/ossec/ folder if you want to remove all files completely.

  2. Disable the Wazuh agent service.

    # systemctl disable wazuh-agent
    # systemctl daemon-reload
    

The Wazuh agent is now completely removed from your Linux endpoint.

Uninstalling a Windows Wazuh agent

To uninstall the agent, the original Windows installer file is required to perform the unattended process:

msiexec.exe /x wazuh-agent-4.7.4-1.msi /qn

The Wazuh agent is now completely removed from your Windows endpoint.

Uninstalling a macOS Wazuh agent

Follow these steps to uninstall the Wazuh agent from your macOS endpoint.

  1. Stop the Wazuh agent service.

    # /Library/Ossec/bin/wazuh-control stop
    
  2. Remove the /Library/Ossec/ folder.

    # /bin/rm -r /Library/Ossec
    
  3. Stop and unload dispatcher.

    # /bin/launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist
    
  4. Remove launchdaemons and StartupItems.

    # /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
    # /bin/rm -rf /Library/StartupItems/WAZUH
    
  5. Remove the Wazuh user and group.

    # /usr/bin/dscl . -delete "/Users/wazuh"
    # /usr/bin/dscl . -delete "/Groups/wazuh"
    
  6. Remove from pkgutil.

    # /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent
    

The Wazuh agent is now completely removed from your macOS endpoint.

Uninstalling a Solaris Wazuh agent

Select the Solaris version you want to uninstall.

Run the following command to uninstall the Wazuh agent in Solaris 10.

# pkgrm wazuh-agent

The Wazuh agent is now completely removed from your Solaris endpoint.

Uninstalling an AIX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the AIX endpoint.

# rpm -e wazuh-agent

Some files are not removed from the filesystem by the package manager. Delete the /var/ossec/ folder if you want to remove all files completely.

The Wazuh agent is now completely removed from your AIX system

Uninstalling an HP-UX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the HP-UX endpoint.

  1. Stop the Wazuh agent service.

    # /var/ossec/bin/wazuh-control stop
    
  2. Delete wazuh user and group:

    # groupdel wazuh
    # userdel wazuh
    
  3. Remove Wazuh files.

    # rm -rf /var/ossec
    

The Wazuh agent is now completely removed from your HP-UX endpoint.