Some of our servers have a script running that generates an Eicar file and 12 hours later will check to see if the file was deleted by SEP or is still on the server. This is a very simple script that's been running on these servers without a single fail for several years until we upgraded to 12.1.6.
Since the upgrade it will usually delete the file, but not reliability. It's always able to detect the file when we access it, but if we create the file without trying to read or run it, then it doesn't always detect it. It seems to fail more often during weekly full backups.
We opened a support request with Symantec.. They suggested that we disable deferred scanning.. Since making this change, the script appears to be working reliably now.
I didn't personally open the support request Symantec, but I didn't get the sense that this was seen as a bug that they were planning to fix.
What do you folks think.. Is this expected behavior? Is this acceptable behavior?