You have two options for running DTrace:
I prefer the second method using the command line. With the command line DTrace utility, you can trace more granularly and it performs traces that aren't possible in the GUI (like tracing EVPM).
Logged in as the EV service account, open a command line window and navigate to the Enterprise Vault Program FIles directory. run dtrace.
cd "C:\Program Files\Enterprise Vault" dtrace
Select the component/service you want to trace. ( use ? to list all services and the linked service number ). Place a "v" after the selected service number to indicate that verbose logging is used.
Set <service_number> v
Start logging to a file (ex.: "trace.log")
log <filename>.log
Stop logging:
log