Hi Guys,
We have a very large syslog table in at least one of our setups which we are trying to reduce however while digging around the timeout information I came across the the query that is being run by the message center page when you as for syslog info to be included.
It looks like the SQL logic currently union syslog, alerts, events and traps each filtered by the date range specified it then does a sort and finally applies a TOP x to the query. This issue as I see it is that if you have 500,000 syslog messages in the the time windows then they will all get returned unioned to the alerts, events and traps sorted before the TOP x is applied. My SQL skill are some what limited but i would imagine if each of these tables was queries using a TOP X time window and sorted the results put into a temp table and then those results unioned back together sorted and finally reapply the TOP X would still return the result but would mean that you are not having to sort the whole 500,000 syslog messages in memory and the SQL query engine should be able to use the indexes it has to help.
Hope that makes sense like i say i could be way off the mark with this one but an more than happy to discuss the idea with someone.
JonnyG
note i also have a support call open for this issue 387645
