Uninstalling GuardMode Agent on Linux

1. Before uninstallation, ensure that the GuardMode Agent service is stopped and disabled. This prevents the service from automatically starting during the uninstallation process:

systemctl stop Catalogic.GuardMode.Agent.service
systemctl disable Catalogic.GuardMode.Agent.service

2. Next, remove symbolic links and files related to the GuardMode Agent service:

find /etc/systemd/system/ -type l -name "*Catalogic.GuardMode.Agent*" -exec echo "removing {}" \; -exec rm -f {} \;
find /etc/systemd/system/ -type f -name "*Catalogic.GuardMode.Agent*" -exec echo "removing {}" \; -exec rm -f {} \;
find /usr/lib/systemd/system/ -type l -name "*Catalogic.GuardMode.Agent*" -exec echo "removing {}" \; -exec rm -f {} \;
find /usr/lib/systemd/system/ -type f -name "*Catalogic.GuardMode.Agent*" -exec echo "removing {}" \; -exec rm -f {} \;

3. Adjust system service properties:

sed -i 's/^RefuseManualStop=no$/RefuseManualStop=yes/' /usr/lib/systemd/system/auditd.service

# For OES 2023 only:
sed -i 's/^[ \t]*ProtectHome=read-only$/ProtectHome=true/' /usr/lib/systemd/system/augenrules.service
sed -i 's/^[ \t]*ProtectHome=read-only$/ProtectHome=true/' /usr/lib/systemd/system/auditd.service

4. Reload the system daemon:

systemctl daemon-reload

5. Remove the GuardMode Agent installation directory and any related configuration files:

rm -rf /opt/catalogic/guard-mode/agent
rm -f /etc/audit/rules.d/GuardMode.rules
rm -f /etc/audit/plugins.d/CatalogicAuditDispatcher.conf
rm -f /etc/audisp/plugins.d/CatalogicAuditDispatcher.conf

6. Update Audit Rules and Restarting the Service:

augenrules
systemctl restart auditd.service

7. (Optional) Depending on your specific requirements, you might want to remove auditd from your system.

Tip. Audit packages might be installed by default.

For RHEL 7, 8, 9:

yum remove audit audit-libs libicu

For OES 2023:

zypper remove audit libaudit1 libauparse0