We've been seeing some false alarms with real time protection on some servers when they boot up. It seems to be a timing issue with the sav-rms and sav-protect systemd service files. If sav-rms.service starts before sav-protect.service, it will report that real time protection is disabled for a few minutes. I changed the After= line for sav-rms.service to include sav-protect.service and I don't see the false alarms any more.