SpIDer Guard, the file system monitor, can operate in one of the following modes:

•FANOTIFY—using the fanotify monitoring interface (not all GNU/Linux-based OSes support fanotify)

•LKM—using the loadable Linux kernel module (compatible with any GNU/Linux-based OS with kernel 2.6.x and newer)

By default, the file system monitor automatically chooses the appropriate operation mode according to the environment. If SpIDer Guard cannot be started, build and install a loadable kernel module by using the supplied source codes.