Uninstalling Installed Products and OMT from an On-Premises Installation

The ArcSight Platform Installer simplifies the uninstall procedure.

Prerequisites

Ensure the following before you begin:

• Verify that the ArcSight Platform Installer was used to deploy the original cluster. If it was not used to deploy the cluster, then use the manual method of uninstalling OMT.

• The uninstallation process requires all installed software images and the yaml configuration file to reside in appropriate locations on the master node used during the original installation.

You are now ready to begin the uninstallation.

1. On the master node:
   1. Log in to the master node and execute the uninstall command from /opt/arcsight-platform-installer-x.x.x.x/

      #./arcsight-install -c /opt/my-install-config.yaml --cmd uninstall

   2. Execute the following commands to remove these directories from /opt.

      # rm -rf /opt/arcsight/

      # rm -rf /opt/arcsight-db-tools/

      # rm -rf /opt/containerd/

   3. Execute the following commands to remove these directories from /root.

      # rm -rf /root/.kube/

      (Conditional) # rm -rf /root/.ssh/

2. On the OMT worker nodes:

   1. Execute the following commands to these current installation directories from /opt

      # rm -rf /opt/arcsight/

      # rm -rf /opt/containerd/

   2. Execute the following commands to remove these directories from /root

      # rm -rf /root/.kube/

      (Conditional) # rm -rf /root/.ssh/

3. On each ArcSight Database node:

   1. Execute the following commands to remove the arcsight-database directory as follows:

      # rm -rf /opt/arcsight-db-tools

      (Conditional) # rm -rf /root/.ssh/

4. On the NFS nodes:

   1. Execute the following commands to remove the arcsight-nfs directory :

      # rm -rf /opt/arcsight-nfs

   2. Execute the following command to remove all content (related to /opt/arcsight-nfs) from the exports file:

      # vi /etc/exports

   3. Execute the following command to unexport all directories deleted in the previous step:

      # exportfs -ra

   4. (Conditional) Execute the following commands to remove the .ssh/ directory from /root:

      # rm -rf /root/.ssh/

You can now proceed to uninstall your installed products.

1. On all master nodes and all worker nodes:

   1. Execute the uninstall command from /opt/arcsight/kubernetes/:

      # ./uninstall.sh

   2. Manually delete the /opt/arcsight directory.

2. On the master node, uninstall the ArcSight Database:

   1. Execute the uninstall command from /opt/arcsight-db-tools:

      ./db_installer uninstall

3. On each ArcSight Database node:

   1. Execute the following command to remove the /opt/arcsight-db-tools directory as follows:

      # rm -rf /opt/arcsight-db-tools

   2. (Conditional) Execute the following command to remove .ssh/ directory from /root:

      # rm -rf /root/.ssh/

You can now proceed to uninstall your installed products.

If you are also uninstalling OMT, then prior to uninstalling your products, perform the uninstallation of OMT first (using either the ArcSight Installer or manually), and then return here to proceed with uninstalling your products.

1. Log in to the master node and become root.
2. Get the names of all namespaces by running the command:
   kubectl get namespaces

For example:

kubectl get namespaces

NAME                       STATUS   AGE

arcsight-installer-blk62   Active   41m

core                       Active   48m

default                    Active   84m

kube-public                Active   84m

kube-system                Active   84m

3. Delete the product namespaces you wish to delete, and the core namespace by running the command:
   kubectl delete namespace <namespace name>

For example:

kubectl delete namespace arcsight-installer-blk62

namespace "arcsight-installer-blk62" deleted

kubectl delete namespace core

namespace "core" deleted

4. Wait for the selected namespaces to be deleted before continuing.
5. Get the names of all PVs (persistent volumes) by running the command:
   kubectl get pv

For example:

kubectl get pv

NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS

arcsight-installer-blk62-arcsight-volume   30Gi       RWX            Retain           Released

arcsight-installer-blk62-db-backup-vol     1Mi        RWX            Retain           Released

db-single                                  10Gi       RWX            Retain           Released

itom-logging                               1Mi        RWX            Retain           Released

itom-vol                                   5Gi        RWX            Retain           Released

6. Delete all PVs by running the following command for each PV:
   kubectl delete pv <PV_name>

kubectl delete pv arcsight-installer-blk62-arcsight-volume

persistentvolume "arcsight-installer-blk62-arcsight-volume" deleted

kubectl delete pv arcsight-installer-blk62-db-backup-vol

persistentvolume "arcsight-installer-blk62-db-backup-vol" deleted

kubectl delete pv db-single

persistentvolume "db-single" deleted

kubectl delete pv itom-logging

persistentvolume "itom-logging" deleted

kubectl delete pv itom-vol

persistentvolume "itom-vol" deleted

7. Clear the data from your NFS volumes by connecting with SSH and clearing (but not deleting) all exported directories.