Ok, to make a long story short, if I launch SWQL Studio, select 'Cirrus.Audit' on the left, right-click and 'Generate Select Statement', that works. If I then attempt to Query that, it fails with a dialog that says, "Unknown provider Cirrus." and the xml error in the Log says:
2013-07-26 14:08:38,614 [82] ERROR SolarWinds.InformationService.Core.InformationService - Exception running query:
SELECT ID, UserName, ModuleName, Type, Action, Details, DateTime
FROM Cirrus.Audit
RETURN XML RAW
2013-07-26 14:08:38,614 [82] ERROR SolarWinds.InformationService.Core.InformationService - Exception for Operation: <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<a:Action s:mustUnderstand="1">http://schemas.solarwinds.com/2007/08/informationservice/InformationService/QueryXml</a:Action>
<a:MessageID>urn:uuid:8480529e-8c42-4c04-9d58-5f8534576fd4</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<i18n xmlns="http://schemas.solarwinds.com/2007/08/informationservice" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<Culture>en-US</Culture>
</i18n>
<a:To s:mustUnderstand="1">net.tcp://solarwinds-npm.pavlovmedia.corp:17777/SolarWinds/InformationService/v3/Orion/ad</a:To>
</s:Header>
<s:Body>
<QueryXml xmlns="http://schemas.solarwinds.com/2007/08/informationservice">
<query>SELECT ID, UserName, ModuleName, Type, Action, Details, DateTime
FROM Cirrus.Audit
RETURN XML RAW</query>
<parameters>
</parameters>
</QueryXml>
</s:Body>
</s:Envelope>
2013-07-26 14:08:38,614 [82] ERROR SolarWinds.InformationService.Core.InformationService - Exception caught in method RunQuery
SolarWinds.Data.Query.QueryExecutionException: Unknown provider Cirrus.
at SolarWinds.Data.Query.LogicalQueryPlan.PassThroughEvaluator.IdentifyDataProviders(IDataProviderCatalog catalog, PreProcessorState queryState, SelectStatement selectStatement)
at SolarWinds.Data.Query.LogicalQueryPlan.PassThroughEvaluator.CanExecuteUsingPassThrough(IDataProviderCatalog catalog, PreProcessorState queryState, SelectStatement selectStatement)
at SolarWinds.Data.Query.LogicalQueryPlan.LogicalQueryPlanFacade.GenerateLogicalQueryPlan(SelectStatement selectStatement, IDataProviderCatalog dataProviderCatalog, PreProcessorState preProcessorState)
at SolarWinds.Data.Query.Engine.QueryProcessor.Execute(SelectStatement selectStatement, IQueryExecutionContext context, PreProcessorState preProcessorState)
at SolarWinds.Data.Query.Engine.QueryProcessor.ProcessInternal(String query, IQueryExecutionContext context)
at SolarWinds.Data.Query.Engine.QueryProcessor.ProcessQueryWithDeferredReaderCreation(String query, IQueryExecutionContext context)
at SolarWinds.InformationService.Core.InformationService.<>c__DisplayClass21.<RunQuery>b__1e()
at SolarWinds.InformationService.Core.QueryPlanCache.GetQueryPlan(String query, String username, Func`1 buildQueryPlan)
at SolarWinds.InformationService.Core.InformationService.RunQuery(String query, IDictionary`2 parameters, IDataSerializer serializer)
HOWEVER: If I do a QueryXml with perl using the exact same SELECT, it works fine.
my $query = 'SELECT ID, Action, DateTime, Details, ModuleName, Type, Username, Description, DisplayName, InstanceType, Uri FROM Cirrus.Audit';
$swis->want_som(1);
my $som = $swis->QueryXml( $query );
$som->match('//queryResult/data/Audit');
my @audit = $som->valueof();
.....
This appears to be a long-standing bug with SWQL Studio itself, as it has behaved this way since I started using SDK 1.5, SDK 1.6, and now SDK 1.7.
Could this please be fixed in a future release of the SDK?
Also, expanding the verbs underneath any of the tables is about the clearest way to find documentation for what parameters are required, and this isn't working either. (IE compare expanding Orion.Nodes.PollNow vs Cirrus.Nodes.AddNode and see the difference... the latter displays none of the parameters I know it needs, while the former does. I expect this failure has the same underlying cause as the inability to query the Cirrus.* tables.
Thanks!
I got into this only because one of my team is working on NCM configuration, and he finds the event viewer in the NCM Gui nearly unusable, as it offers no way to search for the events related to a specific device, and won't show ALL events, just a fixed max of 100 or 250 or somesuch.
So I'm making a perl script to dump the entire Cirrus.Audit table to CSV so he can sort through it with a spreadsheet instead.