agent remove

[MNB_1101]

Hi team

One of my agents is removed from the server and added again with a new id and its previous events are deleted. The following message was seen in the server log.

2021/10/11 18:38:26 wazuh-authd: INFO: Duplicated name 'Agent Name' (015). Removing old agent.

[Hanes Nahuel Sciarrone]

Hi mnb,

Thank you for using Wazuh and sharing your question with the community. There are 2 ways to delete the agent which are through the API or CLI. For example, if you want to delete the agent from the API you can use "Dev Tools" option of the Kibana app or do it from the Linux console.

If you want to use CLI mode, you should open the terminal as root on the manager side and run the following command:

/var/ossec/bin/manage_agents -r 002

You should change the 002 to your agent ID.

I would like to know the process you followed to remove the agent to help you.

Best regards

Hanes

[Hanes Nahuel Sciarrone]

Hi mnb,

In the email, I had a mistake. I sent you an image where the API output corresponds to GET /agents. The correct output of API command DELETE /agents?pretty=true&older_than=0s&agents_list=003&status=all is here

I apologize for my mistake.

Best regards

Hanes