#!/bin/sh

# prerm

# stop osqueryd service
if which systemctl >/dev/null 2>&1; then
    systemctl stop osqueryd.service
elif which service >/dev/null 2>&1; then
    service osqueryd stop
elif which invoke-rc.d >/dev/null 2>&1; then
    invoke-rc.d osqueryd stop
else
    /etc/init.d/osqueryd stop
fi

if test -f "/var/run/osquery.pidfile"; then
    kill "$(cat /var/run/osquery.pidfile)" > /dev/null 2>&1;
fi

# erase database and other meta information
# database size over 500mb will drastically affect perfomance
miscdir='/var/osquery/*'
logdir='/var/log/osquery/*'
dbdir='/usr/share/osquery/osquery.dbq/'
rm -rf $miscdir
rm -rf $logdir
rm -rf $dbdir

exit 0