Uninstalling the Wazuh agent

This section describes how to uninstall Wazuh agents installed across the different operating systems below:

Linux
Windows
macOS
Solaris
AIX
HPUX

Uninstalling a Linux Wazuh agent

Run the following commands to uninstall a Linux agent.

Remove the Wazuh agent installation.
# yum remove wazuh-agent
Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Delete the /var/ossec/ folder if you want to remove all files completely.
# apt-get remove wazuh-agent
Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Run the following command If you want to remove all files completely.
# apt-get remove --purge wazuh-agent
# zypper remove wazuh-agent
Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Delete the /var/ossec/ folder if you want to remove all files completely.
# apk del wazuh-agent
Disable the Wazuh agent service.
# systemctl disable wazuh-agent # systemctl daemon-reload
Choose one option according to your operating system.
1. RPM-based operating systems:
# chkconfig wazuh-agent off # chkconfig --del wazuh-agent
1. Debian-based operating systems:
# update-rc.d -f wazuh-agent remove
No action required.

The Wazuh agent is now completely removed from your Linux endpoint.

Uninstalling a Windows Wazuh agent

To uninstall the agent, the original Windows installer file is required to perform the unattended process:

msiexec.exe /x wazuh-agent-4.7.3-1.msi /qn

The Wazuh agent is now completely removed from your Windows endpoint.

Uninstalling a macOS Wazuh agent

Follow these steps to uninstall the Wazuh agent from your macOS endpoint.

Stop the Wazuh agent service.

# /Library/Ossec/bin/wazuh-control stop

Remove the /Library/Ossec/ folder.
# /bin/rm -r /Library/Ossec

Stop and unload dispatcher.

# /bin/launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist

Remove launchdaemons and StartupItems.

# /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
# /bin/rm -rf /Library/StartupItems/WAZUH

Remove the Wazuh user and group.

# /usr/bin/dscl . -delete "/Users/wazuh"
# /usr/bin/dscl . -delete "/Groups/wazuh"

Remove from pkgutil.

# /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent

The Wazuh agent is now completely removed from your macOS endpoint.

Uninstalling a Solaris Wazuh agent

Select the Solaris version you want to uninstall.

Run the following command to uninstall the Wazuh agent in Solaris 10.

# pkgrm wazuh-agent

Run the following command to uninstall the Wazuh agent in Solaris 11.

# /var/ossec/bin/wazuh-control stop
# pkg uninstall wazuh-agent

Note

If you uninstall the Wazuh agent in Solaris 11.4 or later, the Solaris 11 package manager does not remove the group wazuh from the system. Run the groupdel wazuh command to manually remove it.

The Wazuh agent is now completely removed from your Solaris endpoint.

Uninstalling an AIX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the AIX endpoint.

# rpm -e wazuh-agent

Some files are not removed from the filesystem by the package manager. Delete the /var/ossec/ folder if you want to remove all files completely.

The Wazuh agent is now completely removed from your AIX system

Uninstalling an HP-UX Wazuh agent

Follow the steps below to uninstall the Wazuh agent from the HP-UX endpoint.

Stop the Wazuh agent service.
```
# /var/ossec/bin/wazuh-control stop
```
Delete wazuh user and group:
```
# groupdel wazuh
# userdel wazuh
```
Remove Wazuh files.
```
# rm -rf /var/ossec
```

The Wazuh agent is now completely removed from your HP-UX endpoint.