This article provides steps on how to remove an agent from the AEO Manager.
Step 1: Use the manage agents service to remove the agent from the Manager. Provide the ID of the agent you want to remove:
[root@atomic-manager ~]# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v4.0.0 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q: R
Available agents:
ID: 001, Name: DEFAULT_LOCAL_AGENT, IP: 127.0.0.1
ID: 002, Name: linux-agent, IP: any
ID: 003, Name: windows-agent, IP: any
Provide the ID of the agent to be removed (or '\q' to quit):
Step 2: Remove the line with the agent id in /var/ossec/etc/client.keys:
[root@atomic-manager ~]# vi /var/ossec/etc/client.keys
001 DEFAULT_LOCAL_AGENT 127.0.0.1 46760643808e75da0f8208993905458fc36d6297bff9eff475eeb5ea25677033
002 linux-agent any dbd752e9b9c9d3511c8fd11734e2b48efba7087e8b0cf1e76daf96b4d6456d5d
003 windows-agent any aa87a8e874c8e83e5c4afa993c40607d1bae21e884b1a44b66367e61b4e2d0cc
move the cursor to the line of the agent that was removed. Type: dd to remove the agent. Then hit esc : x
so that it saves the changes and exits the file.
Step 3: Restart OSSEC
service ossec-hids restart