---
title: "Enable or disable Fanotify and kernel modules"
slug: "enable-or-disable-fanotify-and-kernel-modules-2"
tags: ["ENS 10.7.x", "Install and Get Started"]
updated: 2026-10-06T16:09:45Z
published: 2026-10-06T16:09:45Z
canonical: "docs.trellix.com/enable-or-disable-fanotify-and-kernel-modules-2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable or disable Fanotify and kernel modules

After installation, you can switch from Fanotify to kernel and conversely.

1. Log on to the system as a user with administrator rights.
2. Run these commands as required:

  - To switch from kernel modules to Fanotify - /mfetpcli --usefanotify
  - To switch from Fanotify to kernel modules - /mfetpcli --usekernelmodule
3. Restart the Trellix Threat Prevention service.

`/opt/McAfee/ens/tp/init/mfetpd-control.sh restart`

> [!NOTE]
> Note
> 
> For Red Hat Enterprise Linux 7.x, CentOS 7.x systems, and Oracle Linux 7.x and later, the kernel module is enabled by default. For Ubuntu and SUSE, Fanotify is enabled by default.