#!/bin/sh

# prerm

# stop osqueryd service
if which systemctl >/dev/null 2>&1; then
    systemctl stop osqueryd.service
elif which service >/dev/null 2>&1; then
    service osqueryd stop
elif which invoke-rc.d >/dev/null 2>&1; then
    invoke-rc.d osqueryd stop
else
    /etc/init.d/osqueryd stop
fi

kill "$(cat /var/run/osquery.pidfile)" > /dev/null 2>&1;

# erase database and other meta information
# database size over 500mb will drastically affect perfomance
miscdir='/var/osquery/*'
logdir='/var/log/osquery/*'
# confdir='/etc/osquery/'
dbdir='/usr/share/osquery/osquery.dbq/'
rm -rf $miscdir
rm -rf $logdir
rm -rf $dbdir

exit 0