Uninstall Snare

Uninstalling the Snare for Linux package is relatively straightforward.

To remove the Snare for Linux binary RPM package:

1. Query the RPM database to ensure Snare for Linux is installed:
   > sudo rpm -qa snare\*

   Note:
   the package name for Snare Agent v5.6.1 or newer is snare-{platform}-agent. For example, for RedHat 8:  snare-rhel-8-agent
   the package name for Snare Agent v5.6.0 or earlier was snarelinux-supp

   


2. Then remove the Snare for Linux RPM package
   > sudo rpm -e <package name>


   • For Snare Agent v5.6.1 or newer (example for RedHat 8): 
     > sudo rpm -e snare-rhel-8-agent


   • For Snare Agent v5.6.0 or earlier: 
     > sudo rpm -e snarelinux-supp

To remove the Snare for Linux binary DEB package:

1. To query the DEB package:
   > sudo dpkg --list snare*
   
   
2. To remove the DEB package: (see the package name from above command)
   > sudo dpkg -r <package name>


   • For Snare Agent v5.6.1 or newer (example for Ubuntu 20): 
     > sudo dpkg -r snare-ubuntu-20-agent
     
     
   • For Snare Agent v5.6.0 or earlier: 
     > sudo dpkg -r snarelinux-supp



The Snare files in /etc/audit will be renamed and backed up, e.g snare.conf-snarebackup.