I'm assuming to uninstall osquery this is the 'gen...
# macos
a
I'm assuming to uninstall osquery this is the 'generic' way on a Mac, yes? Anyone aware of uninstallers/scripts?
Copy code
# default, shouldn't be present with most sync server configs
/bin/launchctl bootout system/io.osquery.agent
# purge the app bundle, symlinks
/bin/rm -rf /opt/osquery
/bin/rm -f /usr/local/bin/osqueryi
/bin/rm -f /usr/local/bin/osqueryctl
# drop the default config/certs, logs, and local db
/bin/rm -rf /private/var/osquery
/bin/rm -rf /private/var/log/osquery
/bin/rm -rf /var/osquery/osquery.db
# forget newer-style pkgid from receipts db
/usr/bin/pkgutil --forget io.osquery.agent
should probably get that added to osqueryctl, at present there's just
clean
which dumps the db