Uninstalling beats on Linux does not stop systemd service

Elastic Stack Beats
,
1

Uninstalling beats (e.g. auditbeat, metricbeat) on Linux (e.g. RHEL 8.10) does not appear to stop the beat process / systemd service. For RPM packages, I believe this should be handled by the %systemd_preun macro in the %preun scriptlet. For DEB, I believe this should be handled by dh_installsystemd if dh is used for generating the DEB package.

Additional info:

> # auditbeat-8.14.3-x86_64.rpm
> cat /etc/redhat-release
Red Hat Enterprise Linux release 8.10 (Ootpa)
> cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="8.10 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.10 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_BUGZILLA_PRODUCT_VERSION=8.10
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.10"
> uname -srvmpio
Linux 4.18.0-553.8.1.el8_10.x86_64 #1 SMP Fri Jun 14 03:19:37 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux
2

Hi,

You can use the systemctl command to stop the service before you uninstall the package. For example, if you're uninstalling Auditbeat, you would run sudo systemctl stop auditbeat before running sudo yum remove auditbeat

Regards

3

@yago82 yes, I am aware of that. I am saying that this should be handled by the package itself. For some reason I am not allowed to post the relevant links, but you can search for "Information on proper handling of unit files in spec file scriptlets can be found here" to find the relevant documentation for Fedora RPM packages.