LEM Reports

Take a look at this:

Best Practices for LEM Memory Allocation

tldr - sounds like you may need to give your LEM box more resources.

If you run the same report for a day's timeframe and it returns data successfully, I'll wager this is the issue.

LEM keeps the last seven days worth of data uncompressed to make Reporting and searching faster.  The assumption is that you'll more frequently want to be investigating what just happened, not ancient history.

After 7 days, LEM compresses the data.  That means any search that includes dates/times outside the last 7 days will require more time and resources as LEM has to find the right compressed DB partition, decompress it, search it, get the data, return the data, re-compress it and move to the next section.

There are also limits in Reports, so any query that would return more than 10 million results (I think) will fail.

If you're regularly expected to present "weeks" worth of data, it may be more efficient to schedule weekly reports and then show multiple weekly reports instead of one "many weeks" report.

Also best to run Database Maintenance Report to keep track of just how many events/logs ARE you sending to the LEM. It may be a LOT more then a user is aware of.

So I tried to first just up the resources to 32GB of RAM but had no luck. So i Just deiced to schedule the report to run the report on Saturday morning of the current week. Thanks for the help.