Uninstalling the Wazuh agent

This section describes how to uninstall Wazuh agents installed across the different operating systems below:

Uninstalling a Linux Wazuh agent

Run the following commands to uninstall a Linux agent.

Note

To uninstall Wazuh agent from a Linux endpoint with the anti-tampering feature enabled, refer to Uninstalling an agent with anti-tampering enabled.

  1. Remove the Wazuh agent installation.

    # apt-get remove wazuh-agent

    Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Run the following command If you want to remove all files completely.

    # apt-get remove --purge wazuh-agent

  2. Disable the Wazuh agent service.

    # systemctl disable wazuh-agent
# systemctl daemon-reload

The Wazuh agent is now completely removed from your Linux endpoint.

Uninstalling a Windows Wazuh agent

To uninstall the Wazuh agent, ensure the original Windows installer file is in your working directory and run the following command:

> msiexec.exe /x wazuh-agent-4.14.0-1.msi /qn

The Wazuh agent is now completely removed from your Windows endpoint.

Uninstalling a macOS Wazuh agent

Follow these steps to uninstall the Wazuh agent from your macOS endpoint.

  1. Stop the Wazuh agent service.

    # launchctl bootout system /Library/LaunchDaemons/com.wazuh.agent.plist

  2. Remove the /Library/Ossec/ folder.

    # /bin/rm -r /Library/Ossec

  3. Remove launchdaemons and StartupItems.

    # /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
# /bin/rm -rf /Library/StartupItems/WAZUH

  4. Remove the Wazuh user and group.

    # /usr/bin/dscl . -delete "/Users/wazuh"
# /usr/bin/dscl . -delete "/Groups/wazuh"

  5. Remove from pkgutil.

    # /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent

The Wazuh agent is now completely removed from your macOS endpoint.

Uninstalling a Solaris Wazuh agent

Select the Solaris version you want to uninstall.

Run the following command to uninstall the Wazuh agent in Solaris 10.

# pkgrm wazuh-agent

The Wazuh agent is now completely removed from your Solaris endpoint.

Uninstalling an AIX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the AIX endpoint.

  1. Run the following commands to uninstall an AIX agent:

    # rpm -e wazuh-agent

Some files are not removed from the filesystem by the package manager. Delete the /var/ossec/ folder if you want to remove all files completely.

The Wazuh agent is now completely removed from your AIX system

Uninstalling an HP-UX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the HP-UX endpoint.

  1. Stop the Wazuh agent service.

    # /var/ossec/bin/wazuh-control stop

  2. Delete wazuh user and group:

    # groupdel wazuh
# userdel wazuh

  3. Remove Wazuh files.

    # rm -rf /var/ossec

The Wazuh agent is now completely removed from your HP-UX endpoint.