empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
345b0a0cd2
fleet/articles/how-to-uninstall-osquery.md
Eric f10e33d387
Website: update article categories (#6679) 
* add deploy category, change product to guides

* update links to deployment guides

* Update deploy-fleet-on-hetzner-cloud.md

* Update enrolling-a-digital-ocean-droplet-on-a-fleet-instance.md

* Update how-to-install-osquery-and-enroll-linux-devices-into-fleet.md

* Update delivering-data-to-snowflake-from-fleet-and-osquery.md

* Update how-to-install-osquery-and-enroll-windows-devices-into-fleet.md

* Update how-to-install-osquery-and-enroll-macos-devices-into-fleet.md

* Update deploying-fleet-on-aws-with-terraform.md

* Update deploying-fleet-on-render.md

* Update how-to-uninstall-osquery.md

* Update osquery-a-tool-to-easily-ask-questions-about-operating-systems.md

* Update get-and-stay-compliant-across-your-devices-with-fleet.md

* Update work-may-be-watching-but-it-might-not-be-as-bad-as-you-think.md

* Update converting-unix-timestamps-with-osquery.md

* Update correlate-network-connections-with-community-id-in-osquery.md

* Update using-elasticsearch-and-kibana-to-visualize-osquery-performance.md

* Update fleet-quick-tips-querying-procdump-eula-has-been-accepted.md

* Update locate-assets-with-osquery.md

* Update osquery-consider-joining-against-the-users-table.md

* Update import-and-export-queries-and-packs-in-fleet.md

* Update ebpf-the-future-of-osquery-on-linux.md

* Update generate-process-trees-with-osquery.md

* Update get-and-stay-compliant-across-your-devices-with-fleet.md

* Update work-may-be-watching-but-it-might-not-be-as-bad-as-you-think.md

* Update ebpf-the-future-of-osquery-on-linux.md

* Change category meta value back to guides

Co-authored-by: Desmi-Dizney <99777687+Desmi-Dizney@users.noreply.github.com>

* change article category

* update latest article category

* add redirects for articles not handled by cloudflare rules

* Update to main nav

I did a little more housekeeping on the main nav for when we do the switch on these categories.

- Added link to /deploy under Guides on the Documentation dropdown.
- Added link to /guides under Guides on the Documentation dropdown
- Removed the now redundant "See all" from under Guides on the Documentation dropdown
- Removed the now redundant "See all" from under Articles on the Community dropdown (There's no need to point users to All categories any more, since all the category land are now linked to independently from the main nav.

* Update article category name

Co-authored-by: Desmi-Dizney <99777687+Desmi-Dizney@users.noreply.github.com>
Co-authored-by: Mike Thomas <mthomas@fleetdm.com>
2022-07-21 13:59:51 +09:00

2.4 KiB
Raw Blame History

How to uninstall osquery

This article walks you through the steps to remove osquery from your device. Remember that if you enrolled this device in a Fleet instance, it would display as an offline host in the Fleet UI until you manually remove it.

On macOS:

Open up your terminal and paste the following commands; note that sudo is required, and you’ll need administrator privileges to complete this process.

sudo launchctl unload /Library/LaunchDaemons/io.osquery.agent.plist
sudo rm /Library/LaunchDaemons/io.osquery.agent.plist
sudo rm -rf /private/var/log/osquery /private/var/osquery
sudo rm /usr/local/bin/osquery*
sudo pkgutil --forget io.osquery.agent

These commands stop the running osquery daemon, remove it from your device, and delete the files created by osquery.

And that’s it; you have now removed osquery from your macOS device.

On Windows:

Removing osquery on Windows 10 is a simple process. To get started, open Windows settings and go to Apps. Then find “osquery” and click Uninstall.

Uninstall osquery

Click Uninstall again to confirm, and osquery will be removed from your Windows device. You might need to restart your computer to complete the uninstall process fully.

On Linux:

  1. Open your terminal and paste the following commands to stop the running osquery service, uninstall osquery, and clean up files created by osquery.

  2. Note that sudo is required, and you’ll need administrative privileges to complete this process.

  3. Using Debian package manager (Debian, Ubuntu, etc.) :

sudo systemctl stop osqueryd.service
sudo apt remove osquery
rm -rf /var/osquery /var/log/osquery /etc/osquery

Using yum Package Manager (RHEL, CentOS, etc.) :

sudo systemctl stop osqueryd.service
sudo yum remove osquery
rm -rf /var/osquery /var/log/osquery /etc/osquery

Are you running into trouble uninstalling osquery on macOS, Windows, or Linux? Get help on Slack in the #fleet channel.