Restarting the sisamdagent service triggers an administrator-defined scan on Symantec Endpoint Protection (SEP) Linux Agent.
This issue occurs on the "retry scan within range" days that have passed since the last scheduled scan run, but the next scheduled scan has not yet come.
When they restarted the client's sisamdagent service, they noticed that about 10 minutes after the service started, an administrator-defined scan started.
For example, a scan scheduled for Wednesday ("Retry the scan within" is his 3 days) as configured. On this client next Monday (5 days after he was scheduled to run on the previous Wednesday) he restarts the sisamdagent service and an administrator defined scan that should have started on Wednesday runs.
14.3 RU4 - RU8
This issue is fixed in 14.3 RU9.
How to get the latest version and how to upgrade are as follows:
Upgrading and Migrating to the Latest Release of Symantec Endpoint Protection (SEP)