Uninstalling the Wazuh central components

You can uninstall all the Wazuh central components using the Wazuh installation assistant.

Run the assistant with the option -u or --uninstall as follows:

$ sudo bash wazuh-install.sh --uninstall

This will remove the Wazuh indexer, the Wazuh server, and the Wazuh dashboard.

If you want to uninstall one specific central component, follow the instructions below.

Note

You need root user privileges to run all the commands described below.

Uninstall the Wazuh dashboard

Remove the Wazuh dashboard installation.

# yum remove wazuh-dashboard -y
# rm -rf /var/lib/wazuh-dashboard/
# rm -rf /usr/share/wazuh-dashboard/
# rm -rf /etc/wazuh-dashboard/

# apt-get remove --purge wazuh-dashboard -y

Remove the Wazuh manager installation.

# yum remove wazuh-manager -y
# rm -rf /var/ossec/

# apt-get remove --purge wazuh-manager -y

Disable the Wazuh manager service.

# systemctl disable wazuh-manager
# systemctl daemon-reload

Choose one option according to your operating system.

# chkconfig wazuh-manager off
# chkconfig --del wazuh-manager

# update-rc.d -f wazuh-manager remove

Remove the Filebeat installation.

# yum remove filebeat -y
# rm -rf /var/lib/filebeat/
# rm -rf /usr/share/filebeat/
# rm -rf /etc/filebeat/

# apt-get remove --purge filebeat -y

Remove the Wazuh indexer installation.

# yum remove wazuh-indexer -y
# rm -rf /var/lib/wazuh-indexer/
# rm -rf /usr/share/wazuh-indexer/
# rm -rf /etc/wazuh-indexer/

# apt-get remove --purge wazuh-indexer -y