Uninstalling the Wazuh central components

Uninstalling deletes the components' data and configuration, including indexed alerts and certificates, and asks for no confirmation. It can also delete the root CA private keys in /etc/wazuh-manager/ca, /etc/wazuh-indexer/ca, and /etc/wazuh-dashboard/ca, which you need to add nodes or renew certificates. The Wazuh agents trust the CA whose certificate is root-ca.pem in /etc/wazuh-manager/ca. Back up anything you want to keep first, these directories included. After an assisted installation, the root CA key is also in the wazuh-ca directory beside the installation assistant, on the host where you ran --generate-config-files. Uninstalling doesn't remove that directory.

You can remove the Wazuh central components in two ways. Use only one. The installation assistant removes every Wazuh central component on the host at once. The package manager removes one component at a time, as described in Uninstall one component with the package manager.

Uninstall all central components with the installation assistant

Follow these steps to uninstall the Wazuh central components with the installation assistant. Back up the CA directories first. Run the mkdir and cp commands at the start of Uninstall one component with the package manager.

  1. If you no longer have the Wazuh installation assistant script, download it:

    # curl -sO https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-install-5.0.0-rc2.sh

  2. Run the Wazuh installation assistant with the option -u or --uninstall as follows:

    # bash wazuh-install-5.0.0-rc2.sh --uninstall

    This removes the Wazuh indexer, Wazuh manager, and Wazuh dashboard packages installed on the host, with their data. It also removes their configuration directories, /etc/wazuh-indexer, /etc/wazuh-manager, and /etc/wazuh-dashboard, including local.env, ca/, certs/, and export/. It also removes the wazuh-indexer, wazuh-manager, and wazuh-dashboard users.

    On the host where you ran --generate-config-files, the wazuh-ca directory beside the installation assistant remains. It holds the root CA private key and the passwords of all the Wazuh users. Remove it after the backup described at the start of this section, or if you won't add nodes or renew certificates:

    # rm -rf ./wazuh-ca

  3. Confirm the removal:

    # rpm -qa 'wazuh-*'

    No Wazuh central component package is listed. On Debian-based systems, dpkg prints dpkg-query: no packages found matching wazuh-* and exits with status 1 when no package matches.

  4. The wazuh-install-files.tar holds the passwords and every node's private key. Remove it along with /var/log/wazuh-install.log, /var/log/wazuh-passwords-tool.log, the assistant script, config.yml, and the other generated files in your working directory:

    # rm -rf /var/log/wazuh-install.log /var/log/wazuh-passwords-tool.log ./wazuh-install-5.0.0-rc2.sh ./config.yml ./artifact_urls_5.0.0-rc2.yaml ./wazuh-install-files.tar ./wazuh-install-packages

If you installed the components step by step, also remove the Wazuh repository as described in Removing the Wazuh repository.

Uninstall one component with the package manager

Remove the components in any order. Removing a component can delete the root CA private key it created, which you need to add nodes or renew certificates. The Wazuh agents trust the CA whose certificate is root-ca.pem in /etc/wazuh-manager/ca. Before you start, copy the CA directory of each component on the host to a safe place. Replace <BACKUP_DIRECTORY> with a directory outside /etc, preferably on another host:

# mkdir -p <BACKUP_DIRECTORY>
# cp -a /etc/wazuh-manager/ca <BACKUP_DIRECTORY>/wazuh-manager-ca
# cp -a /etc/wazuh-indexer/ca <BACKUP_DIRECTORY>/wazuh-indexer-ca
# cp -a /etc/wazuh-dashboard/ca <BACKUP_DIRECTORY>/wazuh-dashboard-ca

Run only the lines for the components installed on the host. Only a Wazuh dashboard whose package issued its own certificates, for example on an all-in-one host, has /etc/wazuh-dashboard/ca. In a distributed deployment, the root CA private key is in /etc/wazuh-indexer/ca on the first Wazuh indexer node after a step-by-step installation. After an assisted installation, it's in the wazuh-ca directory beside the installation assistant, on the host where you ran --generate-config-files. /etc/wazuh-manager/ca holds a key only where the Wazuh manager package issued its own certificates, for example on an all-in-one host. On the other nodes, /etc/wazuh-manager/ca and /etc/wazuh-indexer/ca hold only root-ca.pem. To reinstall later with the same certificates and passwords, also copy the certs and export directories and the local.env file of each component.

Uninstalling the Wazuh dashboard

Run the following commands to stop the Wazuh dashboard, remove its package, and delete its files:

  1. Remove the Wazuh dashboard installation:

    # systemctl disable --now wazuh-dashboard
# apt-get remove --purge wazuh-dashboard -y

Uninstalling the Wazuh manager

Run the following commands to stop the Wazuh manager, remove its package, and delete its directories, including the CA private key:

  1. Remove the Wazuh manager installation:

    # systemctl disable --now wazuh-manager
# apt-get remove --purge wazuh-manager -y
# rm -rf /var/wazuh-manager/

Uninstalling the Wazuh indexer

Run the following commands to stop the Wazuh indexer, remove its package, and delete its data, logs, and configuration. To keep the configuration and data for a reinstall on a DEB system, run apt-get remove wazuh-indexer -y instead.

  1. Remove the Wazuh indexer installation:

    # systemctl disable --now wazuh-indexer
# apt-get remove --purge wazuh-indexer -y
# rm -rf /var/lib/wazuh-indexer/ /usr/share/wazuh-indexer/ /etc/wazuh-indexer/ /var/log/wazuh-indexer/
# rm -rf /etc/systemd/system/wazuh-indexer.service.d/
# systemctl daemon-reload

    dpkg may warn that some directories are not empty. The rm -rf command removes them.

On RPM systems, yum and dnf may also warn that files were saved as .rpmsave. The rm -rf command removes them. To confirm, run dpkg -l 'wazuh-*' (DEB) or rpm -qa 'wazuh-*' (RPM). The output lists no Wazuh central component package.

Checking for leftover directories

The Wazuh central components don't share a directory. Each one keeps its configuration, certificates, and passwords in its own directory: /etc/wazuh-indexer, /etc/wazuh-manager, or /etc/wazuh-dashboard. A package removal can leave that directory behind, as the uninstall steps of each component describe. After you uninstall the last Wazuh central component on a host, check which of these directories remain:

# ls -d /etc/wazuh-indexer /etc/wazuh-manager /etc/wazuh-dashboard

The command prints No such file or directory for each directory that is gone. If one is still there, back up its ca directory if you need it, then remove it:

# rm -rf /etc/wazuh-<COMPONENT>

Replace <COMPONENT> with indexer, manager, or dashboard.

Note

Don't run this command while a Wazuh central component is still installed on the host.

Removing the Wazuh repository

If you removed the last Wazuh central component from a step-by-step host and no Wazuh agent runs on it, remove the Wazuh repository. Also remove its key and the cached packages:

# rm -f /etc/apt/sources.list.d/wazuh.list /usr/share/keyrings/wazuh.gpg /usr/share/keyrings/wazuh.gpg~
# apt-get clean
# apt-get update

After you remove every Wazuh central component from the host, check that none is left. On RPM-based systems, run rpm -qa 'wazuh-*'. On Debian-based systems, run dpkg -l 'wazuh-*'. No Wazuh central component package is listed.