Restarting the Symantec Endpoint Protection Linux Agent or the service "sisamdagent" always triggers an administrator-defined scan.

Products

• Endpoint Protection

Issue/Introduction

Restarting the linux agent after an upgrade causes a scheduled scan to run.

This is causing performance impact, since after a reboot of the server or restart of the Linux agent will trigger a retry scan after 10 minutes, whether or not the previous scan completed successfully.

Environment

Linux Agent Release : 14.3 RU6

Cause

Upon restart of the agent service, if the "Retry Missed Schedule Scans" option is selected;

The agent will mistakenly assume any scheduled scans have failed, therefore causing a rescan.   

The check to see if the scan failed or was successful, always returns back as failed, causing the agent to always retry.

Resolution

This issue has been addressed in 14.3 RU9. 

If an upgrade is not feasible at this time, you can mitigate the issue by disabling 'Missed Scheduled Scans' within the Schedule tab of the Administrator-Defined Scans settings.

The default setting is selected on for 24 hours.  De-selecting this will keep the agent from running a scan after restart or reboot of the server.

 

Select the Schedule Tab;

Uncheck the retry option.