Removing a Collector role instance · MaxPatrol SIEM

Removing a Collector role instance

You can remove the Collector role instances using the Remove-RoleInstance utility supplied with the Collector role. The utility removes the packages of the role and its modules and files from the role data storage directory.

To remove a Collector role instance, you will need the login and password of the account that has the "System management" privilege.

To remove a Collector role instance:On the server on which the Collector role is installed, run the Remove-RoleInstance utility:

/opt/deployer/bin/Remove-RoleInstance.ps1

If there are multiple collectors in the system, in the window that opens, select a role instance to remove, and click Yes. In the window that opens, confirm the role instance removal. In the window that opens, enter the login of the account that has the "System management" privilege, and click OK. In the window that opens, enter the password of the account that has the "System management" privilege, and click OK. The process of the role instance removal starts.

When starting the utility, you can also use the special key host <name of the host on which the role instance is located>. For example, /opt/deployer/bin/Remove-RoleInstance.ps1 -host user-minion*. In this case, the role instance is removed without confirmation. You can specify only one host name for each key.

You can check whether or not the role packages and its modules were removed correctly using the dpkg -l | grep agent command. The removed role instance will no longer be on the collector list on the System → System management page, on the Collectors tab. The /var/log/core-agent and /opt/core-agent directories will also be removed.

If during the first run of the utility you failed to remove all data, you can restart the utility until all data is removed.