From 8eca465ef6c3ba38215010901721d4e2f505d62e Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Fri, 24 Apr 2026 14:35:11 -0400
Subject: [PATCH] uninstall elastic-agent before stopping dockers on reinstall

---
 setup/so-functions | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup/so-functions b/setup/so-functions
index ca58dbbcb..f9b601a93 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1604,6 +1604,9 @@ reinstall_init() {
 		# Drop systemd's in-memory references to the now-removed units
 		systemctl daemon-reload
 
+		# Uninstall local Elastic Agent, if installed
+		elastic-agent uninstall -f
+
 		if command -v docker &> /dev/null; then
 			# Stop and remove all so-* containers so files can be changed with more safety
 			if [[ $(docker ps -a -q --filter "name=so-" | wc -l) -gt 0 ]]; then
@@ -1626,9 +1629,6 @@ reinstall_init() {
 		backup_dir /nsm/hydra "$date_string"
 		backup_dir /nsm/influxdb "$date_string"
 
-		# Uninstall local Elastic Agent, if installed
-		elastic-agent uninstall -f
-
 	} >> "$setup_log" 2>&1
 
 	info "System reinstall init has been completed."