diff --git a/cmd/climc/shell/policies.go b/cmd/climc/shell/policies.go
index fd116c724f..c8d0cb78ba 100644
--- a/cmd/climc/shell/policies.go
+++ b/cmd/climc/shell/policies.go
@@ -134,7 +134,7 @@ func init() {
 		return nil
 	}
 	R(&PolicyPatchOptions{}, "policy-patch", "Patch policy", updateFunc)
-	R(&PolicyPatchOptions{}, "policy-update", "Patch policy", updateFunc)
+	R(&PolicyPatchOptions{}, "policy-update", "Update policy", updateFunc)
 
 	type PolicyPerformOptions struct {
 		ID string `help:"ID of policy to update"`
diff --git a/pkg/keystone/models/identity_provider.go b/pkg/keystone/models/identity_provider.go
index e7ba33f808..a68201a50f 100644
--- a/pkg/keystone/models/identity_provider.go
+++ b/pkg/keystone/models/identity_provider.go
@@ -176,25 +176,35 @@ func (ident *SIdentityProvider) SetSyncStatus(ctx context.Context, userCred mccl
 }
 
 func (ident *SIdentityProvider) MarkConnected(ctx context.Context, userCred mcclient.TokenCredential) error {
-	_, err := db.UpdateWithLock(ctx, ident, func() error {
-		ident.ErrorCount = 0
-		return nil
-	})
-	if err != nil {
-		return err
+	if ident.ErrorCount > 0 {
+		_, err := db.UpdateWithLock(ctx, ident, func() error {
+			ident.ErrorCount = 0
+			return nil
+		})
+		if err != nil {
+			return errors.Wrap(err, "UpdateWithLock")
+		}
 	}
-	return ident.SetStatus(userCred, api.IdentityDriverStatusConnected, "")
+	if ident.Status != api.IdentityDriverStatusConnected {
+		logclient.AddSimpleActionLog(ident, logclient.ACT_ENABLE, nil, userCred, true)
+		return ident.SetStatus(userCred, api.IdentityDriverStatusConnected, "")
+	}
+	return nil
 }
 
-func (ident *SIdentityProvider) MarkDisconnected(ctx context.Context, userCred mcclient.TokenCredential) error {
+func (ident *SIdentityProvider) MarkDisconnected(ctx context.Context, userCred mcclient.TokenCredential, reason error) error {
 	_, err := db.UpdateWithLock(ctx, ident, func() error {
 		ident.ErrorCount = ident.ErrorCount + 1
 		return nil
 	})
 	if err != nil {
-		return err
+		return errors.Wrap(err, "UpdateWithLock")
 	}
-	return ident.SetStatus(userCred, api.IdentityDriverStatusDisconnected, "")
+	logclient.AddSimpleActionLog(ident, logclient.ACT_DISABLE, reason.Error(), userCred, false)
+	if ident.Status != api.IdentityDriverStatusDisconnected {
+		return ident.SetStatus(userCred, api.IdentityDriverStatusDisconnected, reason.Error())
+	}
+	return nil
 }
 
 func (self *SIdentityProvider) AllowGetDetailsConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
@@ -232,7 +242,7 @@ func (ident *SIdentityProvider) PerformConfig(ctx context.Context, userCred mccl
 	if err != nil {
 		return nil, httperrors.NewInternalServerError("saveConfig fail %s", err)
 	}
-	ident.MarkDisconnected(ctx, userCred)
+	ident.MarkDisconnected(ctx, userCred, fmt.Errorf("change config"))
 	submitIdpSyncTask(ctx, userCred, ident)
 	return ident.GetDetailsConfig(ctx, userCred, query)
 }
diff --git a/pkg/keystone/models/syncworker.go b/pkg/keystone/models/syncworker.go
index 8a0cb92028..071d1ecb05 100644
--- a/pkg/keystone/models/syncworker.go
+++ b/pkg/keystone/models/syncworker.go
@@ -47,19 +47,19 @@ func submitIdpSyncTask(ctx context.Context, userCred mcclient.TokenCredential, i
 		conf, err := GetConfigs(idp, true)
 		if err != nil {
 			log.Errorf("GetConfig for idp %s fail %s", idp.Name, err)
-			idp.MarkDisconnected(ctx, userCred)
+			idp.MarkDisconnected(ctx, userCred, err)
 			return
 		}
 		driver, err := driver.GetDriver(idp.Driver, idp.Id, idp.Name, idp.Template, idp.TargetDomainId, idp.AutoCreateProject.Bool(), conf)
 		if err != nil {
 			log.Errorf("GetDriver for idp %s fail %s", idp.Name, err)
-			idp.MarkDisconnected(ctx, userCred)
+			idp.MarkDisconnected(ctx, userCred, err)
 			return
 		}
 		err = driver.Probe(ctx)
 		if err != nil {
 			log.Errorf("Probe for idp %s fail %s", idp.Name, err)
-			idp.MarkDisconnected(ctx, userCred)
+			idp.MarkDisconnected(ctx, userCred, err)
 			return
 		}