On the command line, you can configure system event interception using the InterceptorMode, InterceptorFallbackStrategy, and InterceptorApplyStrategy general application settings.
These settings are displayed and can be modified only on devices where the operating system supports fanotify and satisfies the requirements for installing the updatable kernel module. These settings are applied only if the application is used in Standard mode.
You can change the values of the settings with the help of command line switches or a configuration file that contains all general application settings.
The InterceptorMode lets you select the system event interception mechanism used by the application. This setting can take the following values:
UseFanotify – use the fanotify technology to intercept system events.UseUpdatableKernelModule – use an updatable kernel module to intercept system events.The InterceptorFallbackStrategy setting is applied if the updatable kernel module is selected. This setting lets you specify what the application does if the updatable kernel module fails to start. This setting can take the following values:
FallbackToFanotify switches the system event intercept mechanism to fanotify in case the updatable kernel module fails to start.FallbackToLimitedMode turns off system event interception in case the updatable kernel module fails to start. If the application does not use system event interception, real-time file scanning is not performed, and the protection level of the device is reduced.The InterceptorApplyStrategy setting is applied if the updatable kernel module is selected. If the application switches to using the updatable kernel module, the application must be restarted to start the module. This setting lets you specify if you want the application to be restarted automatically or if you prefer to restart the application manually:
RestartServiceAutomatically automatically restarts the application to start the updatable kernel module.RestartServiceManually starts the updatable kernel module after the application is restarted manually by the user.We recommend automatically restarting the application to switch to using the updatable kernel module. Starting the updatable kernel module manually after restarting the application can lead to application errors.
Page top