How do we uninstall osquery on a centos? Is it documented somewhere? I used 'yum remove osquery'. Only the package is removed. But the config and log files still persists.

Having the config and log files stay around should be a common expectation (if I’m wrong about this please correct me!) I think that’s all you need to manually remove.

thank you @theopolis. So the config and log files need to be manually removed. Right?

I don’t think this is an osquery question — it’s a question about how rpm packages work. I don’t know those semantics, but I’d expect you need manual removal. On debian derived operating systems. this is the difference between

remove

and

purge