> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.8-eol/cortex-xdr-agent-7.8-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md).

# Uninstall the Cortex XDR Agent for Linux

From the Cortex XDR management console you can uninstall the Cortex XDR agent on a Linux server (refer to Uninstall the Cortex XDR Agent in the Administrator’s Guide for your license version. You can also uninstall the agent directly on the server. Successfully uninstalling the Cortex XDR agent program effectively removes the agent from the server.

After you uninstall the agent, your server will no longer be protected by your organization’s security policies in Cortex XDR.

1. Uninstall using package manager.
   1. Depending on your Linux distribution, uninstall the Cortex XDR agent using one of the following commands:
      * For RHEL, CentOS, or Oracle distributions, use the **`yum remove cortex-agent`** or **`rpm —e cortex—agent`** command.
      * For Ubuntu or Debian distributions, use the **`apt—get remove cortex—agent`** command.
      * For SuSE distributions, use the **`zypper rm cortex—agent`** or **`rpm —e cortex—agent`** command.
2. Uninstall using a shell script.

   If you used the shell script to install the Cortex XDR agent, you can use the corresponding uninstall shell script to uninstall the agent. You cannot use the script to uninstall agents installed using other methods.

   1. On the Linux server, run the uninstall.sh script and confirm you want to uninstall the Cortex XDR agent.

      The `uninstall.sh` script is located in the `/opt/traps/scripts` directory. By default, the script removes all logs, keys, and other files related to the Cortex XDR agent. If you want to preserve the logs, run the uninstall script in light mode using the **`—l`** option.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>To use the uninstall script, you must run it from the default location in the scripts directory, and as root or with root permissions.</p></div>

      ```screen
                                    root@ubuntu:/$
                                      /opt/traps/scripts/uninstall.sh
                                      This operation will uninstall Cortex XDR agent, are you sure? [y/N]:
                                      y
                                      [1] Shutting down Cortex XDR services
                                      Done
                                      [2] Waiting on active AppArmor policy updates
                                      Done
                                      [3] Removing AppArmor policies
                                      * cortex xdr
                                      Done
                                      [4] Stopping Cortex XDR security services (systemd)
                                      Removed symlink /etc/systemd/system/multi-user.target.wants/traps_trapsd.service.
                                      Removed symlink /etc/systemd/system/multi-user.target.wants/traps_pmd.service.
                                      Removed symlink /etc/systemd/system/multi-user.target.wants/traps_authorized.service.
                                      Done
                                      [5] Removing Cortex XDR agent
                                      Done
                                  
      ```
   2. Confirm that the agent is no longer installed.

      From the Linux server you can verify the removal of the traps folder in /opt/. From Cortex XDR, you can also verify that the server was removed from the **Endpoints** page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.8-eol/cortex-xdr-agent-7.8-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.