Skip to main content

How to uninstall Auditbeat on Linux

This guide will walk you through uninstalling the Auditbeat agent on Linux.

Written by Alan Butcher

Uninstalling Auditbeat

  1. Open a Terminal window.

  2. Stop the Auditbeat service using the following command:
    ​sudo systemctl stop auditbeat

  3. Disable the service to prevent it from starting on boot:
    ​sudo systemctl disable auditbeat

  4. Uninstall the Auditbeat package:
    ​sudo apt-get purge auditbeat

  5. Remove any residual files and directories:
    ​sudo rm -rf /etc/auditbeat && sudo rm -rf /var/lib/auditbeat && sudo rm -rf /var/log/auditbeat

Verifying the uninstall is complete

  1. Run the following command and confirm no results are returned:
    ​dpkg -l | grep auditbeat

  2. Run the following command and confirm the service can no longer be found:
    ​sudo systemctl status auditbeat

And that's it! You've successfully uninstalled Auditbeat. 🎉

Did this answer your question?