Uninstalling the Wazuh central components
You can uninstall all the Wazuh central components using the Wazuh installation assistant.
Run the assistant with the option -u
or --uninstall
as follows:
$ sudo bash wazuh-install.sh --uninstall
This will remove the Wazuh indexer, the Wazuh server, and the Wazuh dashboard.
If you want to uninstall one specific central component, follow the instructions below.
Note
Root user privileges are required to execute all the commands described below.
Uninstall the Wazuh dashboard
Remove the Wazuh dashboard installation.
# yum remove wazuh-dashboard -y # rm -rf /var/lib/wazuh-dashboard/ # rm -rf /usr/share/wazuh-dashboard/ # rm -rf /etc/wazuh-dashboard/
# apt remove --purge wazuh-dashboard -y
Uninstall the Wazuh server
Remove the Wazuh manager installation.
# yum remove wazuh-manager -y # rm -rf /var/ossec/
# apt remove --purge wazuh-manager -y
Disable the Wazuh manager service.
# systemctl disable wazuh-manager # systemctl daemon-reload
Choose one option according to your operating system.
RPM based operating systems:
# chkconfig wazuh-manager off # chkconfig --del wazuh-manager
Debian based operating systems:
# update-rc.d -f wazuh-manager remove
Remove the Filebeat installation.
# yum remove filebeat -y # rm -rf /var/lib/filebeat/ # rm -rf /usr/share/filebeat/ # rm -rf /etc/filebeat/
# apt remove --purge filebeat -y