Uninstall

Uninstall

This guide covers how to completely remove HookProbe from your system.

Quick Uninstall

sudo hookprobe-ctl uninstall

This will:

1. Stop all services
2. Disable systemd units
3. Remove XDP programs
4. Remove containers
5. Remove OVS bridge
6. Remove firewall rules
7. Remove files

What Gets Removed

Services

hookprobe-provision.service
hookprobe-agent.service
hookprobe-update.service
hookprobe-update.timer

Directories

Path	Contents
/opt/hookprobe/	Scripts, agent, data
/etc/hookprobe/	Configuration
/var/log/hookprobe/	Logs

Network

• XDP programs detached
• OVS bridge removed (Fortress)
• Firewall rules removed
• VXLAN tunnels removed

Containers

# All HookProbe containers removed
podman rm --force hookprobe-*

Backup Before Uninstall

Create Backup

sudo tar -czf hookprobe-backup-$(date +%Y%m%d).tar.gz \
  /opt/hookprobe \
  /etc/hookprobe \
  /var/log/hookprobe

Export Data

# Export metrics
hookprobe-ctl metrics --history --since 30d > metrics-export.json

# Export configuration
hookprobe-ctl config show > config-backup.yaml

Partial Removal

Stop Services Only

hookprobe-ctl stop

Disable Services

sudo systemctl disable hookprobe-agent.service
sudo systemctl disable hookprobe-provision.service

Remove XDP Only

# Remove XDP from interface
sudo ip link set dev eth0 xdpgeneric off
sudo ip link set dev eth0 xdpdrv off

Remove OVS Only (Fortress)

# Delete OVS bridge
sudo ovs-vsctl del-br br0

Manual Uninstall

For complete manual removal:

# 1. Stop services
sudo systemctl stop hookprobe-agent.service
sudo systemctl stop hookprobe-provision.service

# 2. Disable services
sudo systemctl disable hookprobe-agent.service
sudo systemctl disable hookprobe-provision.service

# 3. Remove systemd units
sudo rm /etc/systemd/system/hookprobe-*.service
sudo rm /etc/systemd/system/hookprobe-*.timer
sudo systemctl daemon-reload

# 4. Remove XDP
sudo ip link set dev eth0 xdpgeneric off 2>/dev/null
sudo ip link set dev eth0 xdpdrv off 2>/dev/null

# 5. Remove OVS (Fortress)
sudo ovs-vsctl del-br br0 2>/dev/null

# 6. Remove containers
podman rm --force $(podman ps -a --filter name=hookprobe -q) 2>/dev/null

# 7. Remove directories
sudo rm -rf /opt/hookprobe
sudo rm -rf /etc/hookprobe
sudo rm -rf /var/log/hookprobe

# 8. Remove firewall rules (ufw)
sudo ufw delete allow 8888/tcp
sudo ufw delete allow 8144/udp
sudo ufw delete allow 7946

# 9. Remove Python packages (optional)
pip3 uninstall hookprobe -y 2>/dev/null

Verify Removal

Check Services

systemctl list-units | grep hookprobe
# Should return nothing

Check Processes

ps aux | grep hookprobe
# Should return nothing

Check Directories

ls /opt/hookprobe 2>/dev/null
ls /etc/hookprobe 2>/dev/null
# Should show "No such file or directory"

Check XDP

ip link show | grep xdp
# Should show no xdp attachments

Check Containers

podman ps -a | grep hookprobe
# Should return nothing

Reinstall

After uninstall, you can reinstall:

git clone https://github.com/hookprobe/hookprobe.git
cd hookprobe
sudo ./install.sh --tier guardian

Restore from Backup

# Extract backup
sudo tar -xzf hookprobe-backup-20251207.tar.gz -C /

# Reinstall
sudo ./install.sh --tier guardian

# Restart services
hookprobe-ctl restart

Clean System Packages

If you want to remove installed dependencies:

# Remove packages (optional - may affect other software)
sudo apt remove --purge podman openvswitch-switch

# Clean up
sudo apt autoremove

Caution

Only remove system packages if you’re sure they’re not used by other software.

Need Help?

If you encounter issues during uninstall:

1. Check logs: journalctl -u hookprobe-* --since "1 hour ago"
2. Manual cleanup: Follow steps above
3. Report issues: https://github.com/hookprobe/hookprobe/issues