better query for userlog