Symantec Endpoint Protection (SEP) being restarted automatically on Linux

If you run the following command to stop and disable the SEP:

systemctl stop sisamddaemon

systemctl disable sisamddaemon

The SEP will restart itself later.

For SEP Linux agent version 14.3 RU1 and above, you can stop the SEP Linux agent using the ./stop.sh command in /usr/lib/symantec folder.

However, as per product design, stopping SEP Linux agent is not permanent. Services will be resumed if the Linux machine is restarted.

If you ./stop.sh without reboot. The SEP Linux services will remain fully stop until it is startup using ./start.sh command or on the next system reboot.

The only way to permanently stop the SEP service is uninstall it or temporary ./stop.sh without reboot the system.

How to restart the Endpoint Protection Linux daemons

https://knowledge.broadcom.com/external/article/151271/how-to-restart-the-endpoint-protection-l.html

Symantec Endpoint Protection (SEP) being restarted automatically on Linux