Removing the Unix/Linux Agent

This topic describes how to remove ITM On-Prem (ObserveIT) Unix/Linux Agents from the monitored server(s).

The uninstallation procedure is the same for all supported platforms. The same script can be used to uninstall every supported Unix/Linux platform. For a list of supported Unix/Linux platforms, see Supported Platforms.

In case you have problems with uninstallation, you can create Agent installation logs containing all the messages that were generated during the uninstallation, and send them to Proofpoint support. The uninstallation log will be stored in the directory: /tmp/<pkgname>_uninstall.log where <pkgname> is the name of the Agent installation package.

To remove a Unix/Linux Agent from the server

  1. Log in to the target server with root permissions. Alternatively, use the sudo command.

  2. On the server that you want to stop monitoring, run the command:

    /opt/observeit/agent/bin/uninstall_oit

    This is the default installation path. If you installed the Agent at a different path, you should replace /opt/observeit with that path.

    To prevent current Unix/Linux Agent logs (in the obit.log file) from being deleted during Agent uninstallation, you can run the -b parameter with the uninstall command.

    If a security password is required for uninstalling the Agent (uninstall -p), you must provide a security password in order to proceed with the uninstallation. For further details, see Enabling Installation Security (in the Configuration Guide).

  3. Removal output example:

    Log files will be deleted

    auditing service stop/waiting

    Successfully unregistered this machine

    Removing previous installation of the oit agent

    The configuration file is left intact and can be reused in the future

    (Reading database ... 172632 files and directories currently installed.)

    Removing oit (5.8.0.156-1) ...

    ssh stop/waiting

    ssh start/running, process 27330

    Purging configuration files for oit (5.8.0.156-1) ...

    ssh stop/waiting

    ssh start/running, process 27346

    Processing triggers for ureadahead (0.100.0-16) ...

    The Agent is still running in the server’s memory for the current session. To terminate it, you must close the current session by typing exit or by pressing CTRL+D.