Applies to
Problem description
When the Preview button is clicked, the preview generation lasts unusually long and, when finished, no results are being displayed in the central grid view. The central grid will display the “No events found” message, even though the data search returned information that there are some rows found in the targeted scope (the Total events information below the central grid view), which indicates that, in fact, there is some data to display.
In these scenarios additional problems could occur, when trying to generate report to a file with the same filter criteria, the process would last extensively long (might take hours to complete).
Cause
The problem occurs if there is a large amount of collected auditing data, spread across the active central repository database and its multiple archives, attached as data sources. The preview function will have to query through all that data, across multiple databases, and apply filter criteria along the way which can result in execution timeout. The event counter will collect the number of events matching the filter criteria but generating the view will experience the timeout which is, by default, set to 60 seconds.
The more complex filter criteria are used and the larger amount of data to query is, the greater the probability to encounter this issue is.
Solution 1
Since this is primarily a timeout issue it can be managed. To correct it, open the Options window, and in the General tab find the Global timeout controls. Increasing the value with this control will increase the time available for the preview process to finish. The maximum time to allocate is 1800 seconds (30 minutes):
After these changes are confirmed it is okay to try the preview function again, but with the possibility that it will take some longer time to finish.
Solution 2
As a more efficient approach, the second solution addresses the problem with a large amount of data in data sources to query from. Over time the collected event data can be spread among a larger number of archives which are automatically attached as data sources upon creation. Some of those archives can contain some older data that is out of the time range currently required for retrieval and not necessary to be used as data sources. Removing unnecessary (e.g. older) archives from data sources will decrease the amount of data to retrieve the results from thus significantly reduce the time needed for both, preview and export generation.
To accomplish that open the Options window and from the Reporting tab find the Data sources section. In this section review the list of archives currently attached as data sources and start removing the ones considered unnecessary using the Remove (X) button (archives are automatically created with a timestamp in their name to easily identify what time range is contained within them):
After applying this solution, it will be immediately noticeable that the preview and export performance has been improved.
Affected versions
This issue affects all of ApexSQL Audit versions.
