https://github.com/osquery/osquery logo
#macos
Title
# macos
a

allister

04/07/2023, 6:29 AM
I'm assuming to uninstall osquery this is the 'generic' way on a Mac, yes? Anyone aware of uninstallers/scripts?
Copy code
# default, shouldn't be present with most sync server configs
/bin/launchctl bootout system/io.osquery.agent
# purge the app bundle, symlinks
/bin/rm -rf /opt/osquery
/bin/rm -f /usr/local/bin/osqueryi
/bin/rm -f /usr/local/bin/osqueryctl
# drop the default config/certs, logs, and local db
/bin/rm -rf /private/var/osquery
/bin/rm -rf /private/var/log/osquery
/bin/rm -rf /var/osquery/osquery.db
# forget newer-style pkgid from receipts db
/usr/bin/pkgutil --forget io.osquery.agent
should probably get that added to osqueryctl, at present there's just
clean
which dumps the db
10 Views