# Uninstalling Wazuh 4.14 - Step-by-Step Guide

> Proper removal of Wazuh 4.14 components - agent, manager, indexer, dashboard. Complete and partial data cleanup on Linux, Windows, and macOS

Source: https://opennix.org/en/docs/wazuh/installation/wazuh-uninstalling/


This guide describes the procedure for properly removing Wazuh 4.14 components. Removal can be partial (packages only) or complete (packages + data + configuration). The recommended removal order is: agents first, then dashboard, server, and indexer last.

## Removing an Assisted Installation

If Wazuh was installed using the `wazuh-install.sh` script (all-in-one), use the built-in removal command:

```bash
sudo bash ./wazuh-install.sh -u
```

This command removes all central components and cleans up the configuration. For manual removal of individual components, follow the instructions below.

## Removing the Wazuh Agent

### Linux (DEB - Ubuntu/Debian)

**Stop the service:**

```bash
systemctl stop wazuh-agent
systemctl disable wazuh-agent
```

**Remove the package (preserve configuration):**

```bash
apt-get remove wazuh-agent
```

**Complete removal (package + configuration):**

```bash
apt-get purge wazuh-agent
```

**Clean up remaining files:**

```bash
rm -rf /var/ossec
rm -f /etc/apt/sources.list.d/wazuh.list
rm -f /usr/share/keyrings/wazuh.gpg
```

### Linux (RPM - CentOS/RHEL)

**Stop the service:**

```bash
systemctl stop wazuh-agent
systemctl disable wazuh-agent
```

**Remove the package:**

```bash
yum remove wazuh-agent    # CentOS/RHEL 8 and earlier
dnf remove wazuh-agent    # RHEL 9+ / CentOS Stream 10
```

**Clean up remaining files:**

```bash
rm -rf /var/ossec
rm -f /etc/yum.repos.d/wazuh.repo
```

### Windows

**Stop the service:**

```cmd
NET STOP WazuhSvc
```

**Silent removal via command line:**

```cmd
msiexec /x wazuh-agent-4.14.4-1.msi /q
```

Alternatively, use Control Panel: Programs and Features - Wazuh Agent - Uninstall.

**Clean up remaining files:**

```powershell
Remove-Item -Recurse -Force "C:\Program Files (x86)\ossec-agent"
```

### macOS

**Stop the service:**

```bash
sudo launchctl bootout system /Library/LaunchDaemons/com.wazuh.agent.plist
```

**Remove files:**

```bash
sudo rm -rf /Library/Ossec
sudo rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
sudo rm -rf /Library/StartupItems/WAZUH
```

**Remove the pkgutil record:**

```bash
sudo pkgutil --forget com.wazuh.agent
```

## Removing the Wazuh Dashboard

### Ubuntu / Debian

**Stop the service:**

```bash
systemctl stop wazuh-dashboard
systemctl disable wazuh-dashboard
```

**Remove the package:**

```bash
apt-get remove wazuh-dashboard
```

**Complete removal:**

```bash
apt-get purge wazuh-dashboard
```

**Clean up remaining files:**

```bash
rm -rf /etc/wazuh-dashboard
rm -rf /usr/share/wazuh-dashboard
rm -rf /var/log/wazuh-dashboard
```

### CentOS / RHEL

**Stop the service:**

```bash
systemctl stop wazuh-dashboard
systemctl disable wazuh-dashboard
```

**Remove the package:**

```bash
yum remove wazuh-dashboard    # RHEL 8 and earlier
dnf remove wazuh-dashboard    # RHEL 9+
```

**Clean up remaining files:**

```bash
rm -rf /etc/wazuh-dashboard
rm -rf /usr/share/wazuh-dashboard
rm -rf /var/log/wazuh-dashboard
```

## Removing the Wazuh Server (Manager + Filebeat)

### Ubuntu / Debian

**Stop the services:**

```bash
systemctl stop filebeat
systemctl stop wazuh-manager
systemctl disable filebeat
systemctl disable wazuh-manager
```

**Remove the packages:**

```bash
apt-get remove wazuh-manager filebeat
```

**Complete removal:**

```bash
apt-get purge wazuh-manager filebeat
```

**Clean up remaining files:**

```bash
rm -rf /var/ossec
rm -rf /etc/filebeat
rm -rf /var/lib/filebeat
rm -rf /usr/share/filebeat
```

### CentOS / RHEL

**Stop the services:**

```bash
systemctl stop filebeat
systemctl stop wazuh-manager
systemctl disable filebeat
systemctl disable wazuh-manager
```

**Remove the packages:**

```bash
yum remove wazuh-manager filebeat    # RHEL 8 and earlier
dnf remove wazuh-manager filebeat    # RHEL 9+
```

**Clean up remaining files:**

```bash
rm -rf /var/ossec
rm -rf /etc/filebeat
rm -rf /var/lib/filebeat
rm -rf /usr/share/filebeat
```

## Removing the Wazuh Indexer

### Ubuntu / Debian

**Stop the service:**

```bash
systemctl stop wazuh-indexer
systemctl disable wazuh-indexer
```

**Remove the package:**

```bash
apt-get remove wazuh-indexer
```

**Complete removal:**

```bash
apt-get purge wazuh-indexer
```

**Clean up remaining files (including index data):**

```bash
rm -rf /etc/wazuh-indexer
rm -rf /var/lib/wazuh-indexer
rm -rf /usr/share/wazuh-indexer
rm -rf /var/log/wazuh-indexer
```

### CentOS / RHEL

**Stop the service:**

```bash
systemctl stop wazuh-indexer
systemctl disable wazuh-indexer
```

**Remove the package:**

```bash
yum remove wazuh-indexer    # RHEL 8 and earlier
dnf remove wazuh-indexer    # RHEL 9+
```

**Clean up remaining files:**

```bash
rm -rf /etc/wazuh-indexer
rm -rf /var/lib/wazuh-indexer
rm -rf /usr/share/wazuh-indexer
rm -rf /var/log/wazuh-indexer
```

## Repository Cleanup

After removing all components, remove the Wazuh repository:

### Ubuntu / Debian

```bash
rm -f /etc/apt/sources.list.d/wazuh.list
rm -f /usr/share/keyrings/wazuh.gpg
apt-get update
```

### CentOS / RHEL

```bash
rm -f /etc/yum.repos.d/wazuh.repo
```

## Certificate Cleanup

Remove the certificate archive and generated files:

```bash
rm -f ./wazuh-certificates.tar
rm -f ./wazuh-install-files.tar
rm -rf ./wazuh-certificates
```

## Removing Users and Groups

After a complete uninstallation, the system users and groups can be removed:

```bash
userdel wazuh
groupdel wazuh
userdel wazuh-indexer
groupdel wazuh-indexer
userdel wazuh-dashboard
groupdel wazuh-dashboard
```

## Partial Removal

### Removing data only (preserving configuration)

To clear indexer data without removing the components:

```bash
systemctl stop wazuh-indexer
rm -rf /var/lib/wazuh-indexer/nodes
systemctl start wazuh-indexer
/usr/share/wazuh-indexer/bin/indexer-security-init.sh
```

### Removing specific indices

To delete only alert data through the API:

```bash
curl -k -u admin:<ADMIN_PASSWORD> \
  -X DELETE "https://localhost:9200/wazuh-alerts-*"
```

To delete data for a specific time period:

```bash
curl -k -u admin:<ADMIN_PASSWORD> \
  -X DELETE "https://localhost:9200/wazuh-alerts-4.x-2025.01.*"
```

## Verifying the Removal

After uninstallation, confirm that all components have been fully removed:

```bash
# Check that no packages remain
dpkg -l | grep wazuh     # Ubuntu/Debian
rpm -qa | grep wazuh     # CentOS/RHEL

# Check that no services remain
systemctl list-units | grep wazuh

# Check that no processes remain
ps aux | grep -E "wazuh|ossec" | grep -v grep

# Check that ports are released
ss -tlnp | grep -E "1514|1515|9200|443|55000"
```

## Next Steps

- [Quickstart](/docs/wazuh/installation/wazuh-quickstart/) - reinstall Wazuh
- [Installation Overview](/docs/wazuh/installation/) - choose a deployment model for a fresh installation