Uninstalling the Wazuh agent

This section describes how to uninstall Wazuh agents installed across the different operating systems below:

Uninstalling a Linux Wazuh agent

Run the following commands to uninstall a Linux agent.

Note

To uninstall Wazuh agent from a Linux endpoint with the anti-tampering feature enabled, refer to Uninstalling an agent with anti-tampering enabled.

  1. Remove the Wazuh agent installation.

    # apt-get remove wazuh-agent

    Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. Run the following command If you want to remove all files completely.

    # apt-get remove --purge wazuh-agent

  2. Disable the Wazuh agent service.

    # systemctl disable wazuh-agent
# systemctl daemon-reload

The Wazuh agent is now completely removed from your Linux endpoint.

Uninstalling a Windows Wazuh agent

To uninstall the Wazuh agent, ensure the original Windows installer file is in your working directory and run the following command:

> msiexec.exe /x wazuh-agent-5.0.0-1.msi /qn

The Wazuh agent is now completely removed from your Windows endpoint.

Uninstalling a macOS Wazuh agent

Follow these steps to uninstall the Wazuh agent from your macOS endpoint.

  1. Stop the Wazuh agent service.

    # launchctl bootout system /Library/LaunchDaemons/com.wazuh.agent.plist

  2. Remove the /Library/Ossec/ folder.

    # /bin/rm -r /Library/Ossec

  3. Remove launchdaemons and StartupItems.

    # /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
# /bin/rm -rf /Library/StartupItems/WAZUH

  4. Remove the Wazuh user and group.

    # /usr/bin/dscl . -delete "/Users/wazuh"
# /usr/bin/dscl . -delete "/Groups/wazuh"

  5. Remove from pkgutil.

    # /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent

The Wazuh agent is now completely removed from your macOS endpoint.