Sometimes in order to figure out what is happening in Enterprise Vault FSA it might be necessary to determine which process is recalling items. What I mean is that you might see some sort of mass recall issue, where lots and lots of items are constantly being turned back from placeholders to full-fat items, and, you want to know why!
The way to determine what is recalling the placeholders is to perform a DTrace of the EVPlaceholderService, perform a recall (or leave things running for a while if something is mass-recalling items) and then review the DTrace. In detail then we would:
1. Login to the file server that is hosting the Enterprise Vault placeholder service.
2. Open an elevated command prompt
3. Go to the EV Program Files folder
4. Launch DTrace (by typing dtrace, and then return)
5. Do: set EVPlaceholderService V
6. Do: log c:\temp\who-is-it.log