Uninstall
Uninstall and reinstall
Status: PARTIAL — scripts exist; a certified zero-residue uninstall is NOT_VERIFIED
Purpose
Stop Zwall units and describe what an uninstall does not automatically destroy. This is not a certified residue contract.
Audience
Administrators removing Community or Enterprise components from a host they operate.
Edition
Community ships scripts/uninstall.sh. Enterprise has no single equivalent customer uninstall product; stop the units you installed.
Status
PARTIAL / NOT_VERIFIED as a zero-residue procedure. Classify the gap rather than invent completeness.
Prerequisites
Root. A backup if you might restore (Backup). Understanding which units this host actually has.
Required permissions
Root for systemd and (Community) the uninstall script. PostgreSQL superuser only if you intentionally drop the database — that is not implied by stopping units.
Dependencies
None beyond systemd and, for Community interactive uninstall, the script in the source tree.
Procedure — stop Enterprise units first
Use the names actually installed:
sudo systemctl stop zwall-manager
sudo systemctl stop zwall-agent
sudo systemctl stop zwall-hosting-agent
sudo systemctl stop zwall-hosting-agent-v2
sudo systemctl stop zwall-hosting-ebpf-loaderHosting loader stop path is --detach on zwall-hosting-ebpf-loader (unit ExecStop). Stop the Agent before the loader if both are up.
Then disable if you do not want reboot start:
sudo systemctl disable zwall-manager zwall-agent \
zwall-hosting-agent zwall-hosting-agent-v2 zwall-hosting-ebpf-loaderzwallctl start / stop are not remote implementations.
Procedure — Community
scripts/uninstall.sh exists. It is interactive, must run as root, and supports selective removal: Manager, Agent, or both, with optional eBPF cleanup, database removal, and log cleanup.
Detected path families in that script: /etc/zcs, /var/lib/zcs, /var/log/zcs, /opt/zcs, /var/lib/zwall, unit dir /etc/systemd/system, BPF FS /sys/fs/bpf.
Community scripts/setup.sh failure cleanup stops and disables zwall-manager and zwall-agent, removes those unit files, and preserves directories and database.
Read the script prompts before confirming database drop. Preserve PostgreSQL unless you intentionally restore or drop it.
Data you must treat as separate
Uninstalling binaries does not define a supported destroy of:
Scroll sideways to see the full table. Use the arrow keys when focused.
| Residue | Example location |
|---|---|
| PostgreSQL database | example name zwall_centralized_security |
| Enterprise license identity | /etc/zcs/license/ if present |
| Manager state/logs | /var/lib/zwall-manager, /var/log/zwall-manager |
| Virtualization Agent state | StateDirectory=zcs → /var/lib/zcs; logs /var/log/zcs |
| Hosting identity | /var/lib/zwall-hosting/agent.identity |
| Hosting checkpoints | /var/lib/zwall-hosting/hosting-checkpoints.json |
| Loader runtime | /run/zwall-hosting-ebpf, /var/lib/zwall-hosting-ebpf |
| Pinned maps | /sys/fs/bpf / /sys/fs/bpf/fw |
| Release trust root / verifier | /etc/zwall/release-trust-root.json, /usr/local/libexec/zwall-release |
zwallctl config | ~/.zwallctl/config.yml |
| Community local agent state | setup mentions /root/.zwall |
Do not assume one state path. Reinstall after a failed enroll may require clearing Agent local credentials so a new bootstrap token can register.
systemd credentials under $CREDENTIALS_DIRECTORY (strict mode /run/credentials/zwall-manager.service) are not “deleted by stopping the unit” as a documented wipe of JWT/database material — rotate or remove them as secrets.
Procedure — reinstall
- Backup if the database should survive.
- Stop units; clear Agent identity files if you will re-enroll the same hostname with a new pre-token.
- Follow Community source install or Manager install. Detailed Enterprise verified-release reinstall is provided separately to Enterprise customers.
- Do not run
-migrateas a casual “fix” on a database you intend to keep without Backup.
Verification
systemctl is-active on the units you stopped is inactive. GET /health/live fails if the Manager is gone. PostgreSQL still exists unless you dropped it on purpose.
Expected result
Processes stopped. Data residue called out, not silently destroyed.
Failure modes
Scroll sideways to see the full table. Use the arrow keys when focused.
| Symptom | Meaning |
|---|---|
| Loader still attached | Agent stopped but loader not --detach |
| Re-enroll 4xx | old agent.identity / pre-register mismatch |
| Database gone unexpectedly | uninstall script database option was accepted |
| Maps remain pinned | BPF FS not cleaned — virt only; do not “clean” Hosting by loading firewall.o |
Troubleshooting
If a Hosting observe program remains attached, start the loader with --detach via the unit stop, not by installing Virtualization objects.
Security considerations
Residue includes JWTs, license keys, and admin DB contents. Treat leftover disks as sensitive. Do not paste identity files into tickets.
Limitations
No certified zero-residue Enterprise uninstall. No SLA on backup. Path families are not unified.
Related documentation
- Backup. Restore of a logical dump is not a certified DR product.
- Service control
- Uninstall residue is unresolved. See Status vocabulary.