How to run dtrace using triggers with Enterprise Vault (EV)

When troubleshooting intermittent issues, it is necessary to set up Dtrace to begin capturing only if certain criteria are met. The use of trigger words will help to reduce the size of the Dtrace log because only relevant content will be captured.

To setup Dtrace, review the technical article in the Related articles section below.
The following screen capture shows a simple trigger of " restarting failed process" (Figure 1). The actual search terms will vary depending on the problem being researched.

Figure 1
 

After enabling Dtrace on the desired process, the following parameters should be set at the DT> prompt to enable a trigger on the words " restarting failed process":


DT> trigger

Manage watch entry trigger.     (? for help)

DT Trigger> include "restarting failed process"
'restarting failed process' - added to filter include strings

DT Trigger> q

DT> watch

Watch Trace Output

Maximum number of snapshots [3[ > *enter # of times to capture*
Log file [DTraceWatch.log] > *enter logfile name if desired*
Number of trace entries to display after trigger entry [20] > *set # of lines*
Apply display filter? [Yes/No] (Yes)>

Watching is enabled to 'C:\Program Files\Enterprise Vault\DTraceWatch.log'     (Use 'watch' to disable)