Uninstalling Snort from Linux

Problem

You need to uninstall Snort.

Solution

If you installed Snort using an RPM file, uninstalling is simple. First, determine the RPM installation name by typing the following:

[root@frodo root]# rpm -q snort

snort-2.2.0-1

Then use the RPM erase option:

[root@frodo root]# rpm -e snort-2.2.0-1

All gone!

With the source version, it is just as simple (provided you kept your source tree) in the directory that contains the Makefile, as root type:

[root@frodo snort-2.2.0]# make uninstall

And it automatically uninstalls.

Discussion

In earlier versions of Snort, there is no make uninstall command available, you should have a look through the Makefile, which will tell you what files have been installed where; it is then a matter of deleting them by hand.

Alternatively, if you had the foresight to install all of Snort into a specified directory, rm -rf is also a very effective method of removing all traces.

Don't forget that if you have modified your startup scripts to start a Snort daemon, these need to be changed to reflect the removal of Snort.

If you have not kept your source around, you can install the source, recompile it, and run make install, followed by make uninstall to uninstall.

See Also

Recipe 1.2

RPM utility manpage

Upgrading Snort on Linux