CREATE TABLE [Syslog](
  [MessageID] INTEGER PRIMARY KEY ON CONFLICT REPLACE, 
  [Facility] INTEGER, 
  [Severity] INTEGER, 
  [HostID] INTEGER, 
  [ProcessID] INTEGER, 
  [DateTimeSend] DATETIME, 
  [Message] VARCHAR(4096), 
  [Alert] BOOLEAN, 

CREATE INDEX [idxDateTimeSend] ON [Syslog]([DateTimeSend] DESC);
CREATE INDEX [idxProcessIDSyslogMessages] ON [Syslog]([ProcessID]);
CREATE INDEX [idxAlert] ON [Syslog]([Alert]);
CREATE INDEX [idxHostIDSyslogMessages] ON [Syslog]([HostID]);
CREATE INDEX [idxFacilityIDSyslogMessages] ON [Syslog]([Facility]);
CREATE INDEX [idxSeverityIDSyslogMessages] ON [Syslog]([Severity]);

CREATE TABLE Firewalls (
  [MessageID] INTEGER REFERENCES Syslog(MessageID) ON DELETE CASCADE ON UPDATE CASCADE ,
  [inInterface] VARCHAR(255),
  [outInterface] VARCHAR(255));

CREATE INDEX idxMessageIDFirewalls ON Firewalls(MessageID);
CREATE INDEX idxinInterfaceFirewalls ON Firewalls(inInterface);
CREATE INDEX idxoutInterfaceFirewalls ON Firewalls(outInterface);

SELECT Firewalls.*
FROM Firewalls
LEFT JOIN Syslog ON Firewalls.MessageID=Syslog.MessageID
ORDER BY Syslog.HostID

SCAN TABLE Firewalls
SEARCH TABLE Syslog USING INTEGER PRIMARY KEY (rowid=?)
USE TEMP B-TREE FOR ORDER BY

SELECT Firewalls.*, Syslog.*
FROM Firewalls INNER JOIN Syslog ON Firewalls.MessageID=Syslog.MessageID
WHERE HostID=46 
ORDER BY Syslog.DateTimeSend

SEARCH TABLE Syslog USING INDEX idxHostIDSyslogMessages (HostID=?)
SEARCH TABLE Firewalls USING INDEX idxMessageIDFirewalls (MessageID=?)
USE TEMP B-TREE FOR ORDER BY

EXPLAIN QUERY PLAN SELECT Firewalls.*, Syslog.*
FROM Firewalls INNER JOIN Syslog ON Firewalls.MessageID=Syslog.MessageID
WHERE HostID=46 

SEARCH TABLE Syslog USING INDEX idxHostIDSyslogMessages (HostID=?)
SEARCH TABLE Firewalls USING INDEX idxMessageIDFirewalls (MessageID=?)