Uninstalling CPUSE-Gaia Deployment Agent via CLI

[Nas]

If we have installed DA but want to roll back to previous version. Is there a way to rollback via cli?

On webui , not seeing DA unistall option but only see the jumbo uninstall option.

DA was upgraded to latest by means of Cli and offline method.

[the_rock]

There is an sk about it, cant recall the number now, but if you search cpuse in support center, Im pretty sure there is an explanation there.

Andy

[G_W_Albrecht]

CLI DA install is

rpm -Uhv --force CPda-00-00.i386.rpm

So no need to uninstall, just force it and reboot.

[PhoneBoy]

You can just force install the desired version?

[G_W_Albrecht]

Yes - using force, the old will be overwritten anyway, so it is not needed uninstall the other, newer before as the file name is always identical. Do you remember my CPUSE Deployment Agent install script ? You will have to  use the procedure from there (or directly from  sk92449) to stop and restart DA.

Only in theory you could use rpm:

# $DADIR/bin/dastop
# rpm -e CPda-00-00.i386.rpm

 ...but this will give you an error: package CPda-00-00.i386.rpm not installed

[Daniel_Westlund]

I seem to have high cpu because of the da_cli processes. I stop the DA service, but DA_cli keeps respawning. Since my CPU is at 100%, I'd like to be able to uninstall the client as a workaround to get cpu under control until I can figure out a long-term solution. In that case, is there a way to uninstall it? Like an rpm command?

[the_rock]

Does installer uninstall command from clish give option to remove it?

Andy

[Daniel_Westlund]

No. That is for CP packages you have imported, but not for the deployment agent itself. Thanks.

[the_rock]

Sorry, yes, just realized after I wrote it. Let me see if there is an actual command for it.

Andy

[the_rock]

ChatGPT answer:

To uninstall the Check Point firewall's cpuse agent (which is part of the Gaia operating system), you can follow these general steps. However, be careful when doing so, as it might affect your firewall configuration. Always back up your configuration before making changes.

Here's the command to uninstall the cpuse agent:

1. Log in to the Gaia CLI: Access the firewall's CLI via SSH or directly through the console.

2. Check the installed CPUSE version:

   bash

   Copy code

   cpuse_cli show version

3. Remove the CPUSE agent: Run the following command:

   bash

   Copy code

   rpm -e CPuse

4. Verify removal: Check if the CPUSE agent is successfully uninstalled:

   bash

   Copy code

   cpuse_cli show version

If you encounter any issues or dependencies, you may need to consult Check Point's support or their official documentation. Uninstalling core components might cause service disruptions, so proceed with caution.

AI copilot:

I was hoping it will give something better, but only installer uninstall : - (

Andy

[the_rock]

I think 1st answer it gave was pointless, this one looks better, let me see if I can test in the lab.

Andy

To uninstall the Check Point Firewall CPUSE (Check Point Upgrade Service Engine), follow these steps carefully. Note that you need administrative privileges to perform these actions.

---

Steps to Uninstall Check Point CPUSE:

1. Stop the CPUSE Service

• Log in to the Check Point machine via SSH or directly to the command line.
• Stop the CPUSE service:
  bash

  Copy code

  service cpuse stop
• Alternatively, if you’re using the cpwd utility, you can run:
  bash

  Copy code

  cpwd_admin stop -name CPuseDaemon

---

2. Uninstall CPUSE

• Use the uninstall script provided by Check Point. The script is usually located in the /opt/CPshrd-Rxx/ directory (where Rxx represents the Check Point version, e.g., R81, R80.40, etc.).
• Navigate to the appropriate directory:
  bash

  Copy code

  cd /opt/CPshrd-Rxx/
• Run the uninstall command:
  bash

  Copy code

  ./cpuse uninstall

---

3. Verify Uninstallation

• Once uninstalled, verify that CPUSE is no longer running:
  bash

  Copy code

  ps aux | grep cpuse
• Ensure no CPUSE-related files remain in /opt/CPshrd-Rxx/.

---

4. Clean Residual Files (if necessary)

• If the uninstallation doesn’t completely remove files, you may need to clean up manually:
  bash

  Copy code

  rm -rf /opt/CPshrd-Rxx/CPUSE

---

5. Restart Check Point Services

• After uninstalling CPUSE, restart all Check Point services:
  bash

  Copy code

  cpstop cpstart

---

Notes

• Ensure you back up your system and configurations before proceeding with any uninstall or manual removal steps.
• For managed gateways or appliances, consult Check Point support or refer to official documentation for specific recommendations.
• If you encounter issues, you can review logs for details:
  bash

  Copy code

  cat /var/log/cpuse.log

[Daniel_Westlund]

This is probably the way to go, but I already uninstalled with the rpm. The rpm name wasn't CPuse, but I won't post it here since it is probably not recommend. But, it took my CPU from 0% idle to 60% idle, so worth it to me to keep it uninstalled until we can figure out the issue. TAC was on the call with me the whole time, so maybe they can find the root cause and I can post here when they do. Thanks for the help.

[the_rock]

I just tested it, yes, it did work, but I see your point, better be safe than sorry. No point ruining New Year lol

Andy

[Boaz_Orshav]

Hi Daniel

  I'm the R&D owner of the da_cli and would like to get some details to understand the root cause.

  My guess is that something is calling the da_cli and I'd like to understand who.

  Can you please send me the tgz created by "da_cli collect_logs" to boazo@checkpoint.com ?

Thanks for the cooperation and sorry for the trouble it caused 😞

[Daniel_Westlund]

Hi Boaz. It will probably be a while before I get permission to reinstall CPda, because of vacations. I'll email you the ticket number and later I can troubleshoot with the ticket owner provided you give him steps. Thanks.

[Boaz_Orshav]

Is there any reason to uninstall  the Deployment Agent?

Notice that new packages usually requires new Deployment Agent as a pre-condition so you might find yourself blocked from installing new packages.

[Nas]

Boaz, no issues with it. Due to some company policies its required to demonstrate that we can roll back status of device how it was prior to any work done on that.