SEP Linux agent autoprotect_state OPState

Products

• Endpoint Protection

Issue/Introduction

What does autoprotect_state in sisamd_0.logs mean for SEP Linux Agent?

# cat /var/log/sdcsslog/amdlog/sisamd_0.log | grep autoprotect_state

2025-03-14 08:44:00: <info> [AMDOPState::fetchAMDOpState]:189 OPState: {
    "autoprotect_state": 4,
    "applied_policy": {
        "effective_date": 1741853457,
        "uid": "xxxxxxxxxxxxxxxxxxxxxxxxx",
        "version": 1
    },

Environment

SEP Linux agent 14.3 RU1 and newer

Resolution

"autoprotect_state": 0 // AP(Auto Protect) Disabled by user.
"autoprotect_state": 1 // AP is enabled.
"autoprotect_state": 2 // AP Not installed (Note: Deprecated for Symantec Linux Agent, which has automatic protection)
"autoprotect_state": 3 // AP is disabled due to policy 
"autoprotect_state": 4 // AP is Malfunctioning or has not been initialized because the definition does not exist.