Uninstalling Wazuh with Elastic Stack

This document includes instructions to uninstall the Wazuh components.

Uninstall the Wazuh manager

  1. Remove the Wazuh manager installation.

    Yum

    APT

    ZYpp

    # yum remove wazuh-manager

    There are files marked as configuration files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/ossec.

    # apt-get remove wazuh-manager

    There are certain files marked as configuration files. Due to this designation, the package manager does not remove those files from the filesystem. A complete file removal can be done using the following command:

    # apt-get remove --purge wazuh-manager

    # zypper remove wazuh-manager

    There are files marked as configuration files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/ossec.

  2. Disable the Wazuh manager service.

    Systemd

    SysV init

    # systemctl disable wazuh-manager
# systemctl daemon-reload

    Choose one option according to your operating system.

    1. RPM-based operating systems:

    # chkconfig wazuh-manager off
# chkconfig --del wazuh-manager

    1. Debian-based operating systems:

    # update-rc.d -f wazuh-manager remove

Uninstall Filebeat

Yum

APT

ZYpp

# yum remove filebeat

# apt-get remove filebeat

The Filebeat complete file removal can be accomplished with the following command:

# apt-get remove --purge filebeat

# apt-get remove filebeat

The Filebeat complete file removal can be accomplished with the following command:

# apt-get remove --purge filebeat

Uninstall Elasticsearch

Yum

APT

ZYpp

# yum remove elasticsearch

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/lib/elasticsearch and /etc/elasticsearch.

# apt-get remove elasticsearch

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. A complete file removal can be done using the following command:

# apt-get remove --purge elasticsearch

# zypper remove elasticsearch

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/lib/elasticsearch and /etc/elasticsearch.

Uninstall Kibana

Yum

APT

ZYpp

# yum remove kibana

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/lib/kibana and /etc/kibana.

# apt-get remove kibana

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. A complete file removal can be done using the following command:

# apt-get remove --purge kibana

# zypper remove kibana

There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/lib/kibana and /etc/kibana.