Sophos Anti-Virus for Linux v9: Fanotify Overview

  • Article ID: 118216
  • Rating:
  • 8 customers rated this article 5.9 out of 6
  • Updated: 26 Mar 2013

Known to apply to the following Sophos product(s) and version(s)
Sophos Anti-Virus for Linux v9.0

Operating systems

Fanotify overview

Beta support for Fanotify is included in Sophos Anti-Virus version 9.x. This provides an alternative to Talpa - the current On-Access kernel interface.  Fanotify is available on kernels 2.6.37+

Fanotify is a new file access notification system built-in to later Linux kernels.  This kernel feature allows Sophos Anti-Virus to scan files On-Access and if necessary block access to threats.

With Fanotify, On-Access scanning is available on any 2.6.37+ kernel. It is not necessary for Sophos to include a binary pack for each kernel or for a module to be compiled locally. 

Default kernel interface module
At present Talpa is still the default kernel interface module for On-Access scanning. Sophos provide Talpa Binary Packs for all supported distributions/kernels - so Fanotify is not used by default.

Enabling Fanotify
To enable the Fanotify beta functionality, follow the steps below.  Fanotify will be used as a fallback method if a Talpa Binary Pack cannot be loaded/compiled.

  1. Run the following command:
    /opt/sophos-av/bin/savconfig set DisableFanotify false
  2. Restart SAV:
    /etc/init.d/sav-protect restart

Using Fanotify as the default kernel interface
If required, Fanotify can be set as the default kernel interface and will be used in preference to Talpa. These steps should be followed for users wishing to test Fanotify functionality.

  1. Run the following command:
    /opt/sophos-av/bin/savconfig set PreferFanotify true
  2. Restart SAV:
    /etc/init.d/sav-protect restart

Notes on Fanotify
Use of Fanotify with Sophos Anti-Virus is currently in beta stage. The following caveats apply:

  • Fanotify is built-in to the kernel and not developed by Sophos. Behaviour with Fanotify may differ to Talpa.
  • Fanotify is updated via kernel updates. Behaviour with Fanotify may differ depending on kernel version


If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent