Uninstall the Linux Forwarder

Removing the forwarder takes two steps on Debian and Ubuntu, and three on RHEL and its relatives, because RHEL leaves configuration behind.

Before you start, know what removal does not do. The machine's asset record and every file it ever reported stay exactly where they are. They remain searchable, keep counting toward prevalence, and keep matching YARA rules written months from now. Uninstalling stops collection going forward; it erases nothing that was collected.

That is usually what you want when a machine is being decommissioned. If you only want the machine to stop reporting for a while, Sleep and Wake Forwarders is the reversible option and keeps coverage of everything already on disk.

After removal the asset shows as uninstalled in the web app. To take it out of the default Assets view as well, see Archive Inactive Assets.

Step 1: Stop the service

sudo systemctl stop stairwell.service
sudo service stairwell stop

Run whichever matches the init system on the host. Trying both is harmless; the one that does not apply reports an error and changes nothing.

Step 2: Remove the package

On Debian and Ubuntu, purge takes the configuration with it:

sudo apt purge stairwell

On RHEL, Rocky, and Alma:

sudo rpm -e stairwell
sudo yum remove stairwell

Step 3: Remove configuration, RHEL only

RHEL does not remove configuration files with the package. This is the step people miss, and the symptom is a reinstall that picks up settings nobody remembers choosing.

sudo rm -rf /etc/stairwell/
sudo rm -rf /var/log/stairwell/

Debian and Ubuntu need nothing here, because apt purge already did it.

What should I read next?

• Sleep and Wake Forwarders, if the machine is coming back.
• Archive Inactive Assets, for tidying the fleet list afterwards.
• Install on Linux with a Script, if you are removing in order to reinstall cleanly.