added limit on subquery for speedup the query with more log row
if(!$filter) {
    $query = "select * from (
                (select `cid`, `coid`,`ctype`,`real_name`,`caction`,`cresult`,`cdate`,`cdiff`,`ip_addr`,'mask',`sectionId`,`subnetId`,`ip`.`id` as `tid`,`u`.`id` as `userid`,`su`.`isFolder` as `isFolder`,`su`.`description` as `sDescription`
                from (select * from `changelog` where ctype = 'ip_addr' order by cid desc limit $limit) as `c`, `users` as `u`,`ipaddresses` as `ip`,`subnets` as `su`
                where `c`.`cuser` = `u`.`id` and `c`.`coid`=`ip`.`id` and `ip`.`subnetId` = `su`.`id` )
                union all
                (select `cid`, `coid`,`ctype`,`real_name`,`caction`,`cresult`,`cdate`,`cdiff`,`subnet`,`mask`,`sectionId`,'subnetId',`su`.`id` as `tid`,`u`.`id` as `userid`,`su`.`isFolder` as `isFolder`,`su`.`description` as `sDescription`
                from (select * from `changelog` where ctype = 'subnet' order by cid desc limit $limit) as `c`, `users` as `u`,`subnets` as `su`
                where `c`.`cuser` = `u`.`id` and `c`.`coid`=`su`.`id`) 
            ) as `ips` order by `cid` desc limit $limit;";    
}    
//filter
else {
    /* replace * with % */
    if(substr($expr, 0, 1)=="*")    { $expr[0] = "%"; }
    if(substr($expr, -1, 1)=="*")   { $expr = substr_replace($expr, "%", -1);  }
    $query = "select * from (
                select `cid`, `coid`,`ctype`,`real_name`,`caction`,`cresult`,`cdate`,`cdiff`,`ip_addr`,'mask',`sectionId`,`subnetId`,`ip`.`id` as `tid`,`u`.`id` as `userid`,`su`.`isFolder` as `isFolder`,`su`.`description` as `sDescription`
                from (select * from `changelog` where ctype = 'ip_addr' order by cid desc limit $limit) as `c`, `users` as `u`,`ipaddresses` as `ip`,`subnets` as `su`
                where `c`.`ctype` = 'ip_addr' and `c`.`cuser` = `u`.`id` and `c`.`coid`=`ip`.`id` and `ip`.`subnetId` = `su`.`id`
                union all
                select `cid`, `coid`,`ctype`,`real_name`,`caction`,`cresult`,`cdate`,`cdiff`,`subnet`,`mask`,`sectionId`,'subnetId',`su`.`id` as `tid`,`u`.`id` as `userid`,`su`.`isFolder` as `isFolder`,`su`.`description` as `sDescription`
                from (select * from `changelog` where ctype = 'subnet' order by cid desc limit $limit) as `c`, `users` as `u`,`subnets` as `su`
                where `c`.`ctype` = 'subnet' and  `c`.`cuser` = `u`.`id` and `c`.`coid`=`su`.`id` 
            ) as `ips` 
            where `coid`='$expr' or `ctype`='$expr' or `real_name` like '$expr' or `cdate` like '$expr' or `cdiff` like '$expr' or INET_NTOA(`ip_addr`) like '$expr'
            order by `cid` desc limit $limit;";         
}
            
  
  
     
  
            
               
        
            Anonymous