Uninstallation

This procedure removes Energy Logserver from a RHEL-based system (RHEL, Rocky Linux, AlmaLinux).

Warning

Uninstallation permanently deletes all collected data, indices, dashboards, alert rules, and configuration. Back up anything you want to keep before proceeding. See Backup and Recovery.

Step 1: Stop all services

Stop every ELS component before removing packages:

for svc in logserver-probe alert intelligence intelligence-scheduler automation skimmer cerebro e-doc license-service logserver-gui logserver; do
    systemctl is-active --quiet "$svc" && systemctl stop "$svc"
done

Step 2: Disable services

Prevent the components from restarting on boot:

for svc in logserver-probe alert intelligence intelligence-scheduler automation skimmer cerebro e-doc license-service logserver-gui logserver; do
    systemctl is-enabled --quiet "$svc" 2>/dev/null && systemctl disable "$svc"
done

Step 3: Remove packages

The product ships as several packages. The energy-logserver-* glob covers the platform packages (data node, client node, SIEM plan, Empowered AI, integrations, network probe, automation), while the license service, Skimmer, and the SIEM manager carry their own names:

yum remove -y 'energy-logserver-*' license-service skimmer wazuh-manager

If the host ran the optional Network Probe sensors, remove them as well:

yum remove -y zeek suricata pmacct

Verify nothing remains:

rpm -qa | grep -E 'energy-logserver|license-service|skimmer|wazuh'

The command should return no output.

Warning

Do not use /usr/share/logserver/utils/uninstall.sh. That script predates the 8.x path and service renaming: it stops services that no longer exist under those names, removes directories the current release does not use, and leaves the data directories in place. Follow the procedure on this page instead.

Step 4: Remove residual data and configuration

The package manager removes RPM-tracked files, but data directories, indices, and logs are preserved by design. Remove them manually. Target the real directories, not the product-branded paths: the branded paths (/etc/logserver, /etc/logserver-gui, /etc/logserver-probe, and their /var/lib, /var/log, /usr/share variants) are symlinks that Step 3 already removed with the packages, so deleting them now would leave the actual data behind.

# Data Node (Elasticsearch): config, indices, logs
rm -rf /etc/elasticsearch /var/lib/elasticsearch /var/log/elasticsearch /usr/share/elasticsearch

# GUI (Kibana): config and data
rm -rf /etc/kibana /var/lib/kibana /usr/share/kibana

# Network Probe (Logstash): config, data, logs
rm -rf /etc/logstash /var/lib/logstash /var/log/logstash /usr/share/logstash

# Component directories
rm -rf /opt/alert /opt/cerebro /opt/e-doc /opt/intelligence /opt/license-service /opt/skimmer /opt/automation /opt/ai /opt/plugins /opt/uba

# System tuning files installed by ELS
rm -f /etc/security/limits.d/30-logserver.conf
rm -f /etc/sysctl.d/90-logserver.conf /etc/sysctl.d/90-namespaces.conf

# Cron jobs
rm -f /etc/cron.d/configuration-backup /etc/cron.d/maxmind_geoip_db

Step 5: Reload systemd

systemctl daemon-reload
systemctl reset-failed

Step 6: Revert system settings

The sysctl and limits files were removed in Step 4, but the running kernel still holds the values set during installation. Revert them for the current session, or reboot:

sysctl -w vm.max_map_count=65530
sysctl -w vm.swappiness=60
sysctl -w net.ipv4.tcp_retries2=15

Or simply reboot. The defaults from /etc/sysctl.conf will apply.