Uninstallation

This procedure removes Energy Logserver from a RHEL-based system (RHEL, Rocky Linux, AlmaLinux).

Warning

Uninstallation permanently deletes all collected data, indices, dashboards, alert rules, and configuration. Back up anything you want to keep before proceeding. See Backup and Recovery.

Step 1: Stop all services

Stop every ELS component before removing packages:

for svc in logserver-probe alert intelligence intelligence-scheduler automation skimmer cerebro e-doc license-service logserver-gui logserver; do
    systemctl is-active --quiet "$svc" && systemctl stop "$svc"
done

Step 2: Disable services

Prevent the components from restarting on boot:

for svc in logserver-probe alert intelligence intelligence-scheduler automation skimmer cerebro e-doc license-service logserver-gui logserver; do
    systemctl is-enabled --quiet "$svc" 2>/dev/null && systemctl disable "$svc"
done

Step 3: Remove packages

yum remove -y 'energy-logserver-*'

Verify nothing remains:

rpm -qa | grep -i energy-logserver

The command should return no output.

Step 4: Remove residual data and configuration

The package manager removes RPM-tracked files, but data directories, indices, and logs are preserved by design. Remove them manually. Target the real directories, not the product-branded paths: the branded paths (/etc/logserver, /etc/logserver-gui, /etc/logserver-probe, and their /var/lib, /var/log, /usr/share variants) are symlinks that Step 3 already removed with the packages, so deleting them now would leave the actual data behind.

# Data Node (Elasticsearch): config, indices, logs
rm -rf /etc/elasticsearch /var/lib/elasticsearch /var/log/elasticsearch /usr/share/elasticsearch

# GUI (Kibana): config and data
rm -rf /etc/kibana /var/lib/kibana /usr/share/kibana

# Network Probe (Logstash): config, data, logs
rm -rf /etc/logstash /var/lib/logstash /var/log/logstash /usr/share/logstash

# Component directories
rm -rf /opt/alert /opt/cerebro /opt/e-doc /opt/intelligence /opt/license-service /opt/skimmer /opt/automation /opt/ai /opt/plugins /opt/uba

# System tuning files installed by ELS
rm -f /etc/security/limits.d/30-logserver.conf
rm -f /etc/sysctl.d/90-logserver.conf /etc/sysctl.d/90-namespaces.conf

# Cron jobs
rm -f /etc/cron.d/configuration-backup /etc/cron.d/maxmind_geoip_db

Step 5: Reload systemd

systemctl daemon-reload
systemctl reset-failed

Step 6: Revert system settings

The sysctl and limits files were removed in Step 4, but the running kernel still holds the values set during installation. Revert them for the current session, or reboot:

sysctl -w vm.max_map_count=65530
sysctl -w vm.swappiness=60
sysctl -w net.ipv4.tcp_retries2=15

Or simply reboot. The defaults from /etc/sysctl.conf will apply.