diff --git a/pkg/cloudcommon/db/resourcebase.go b/pkg/cloudcommon/db/resourcebase.go
index 17400da744..d3a72ebea0 100644
--- a/pkg/cloudcommon/db/resourcebase.go
+++ b/pkg/cloudcommon/db/resourcebase.go
@@ -83,7 +83,7 @@ func (model *SResourceBase) GetIResourceModel() IResourceModel {
 
 func (model *SResourceBase) MarkDelete() error {
 	model.Deleted = true
-	model.DeletedAt = timeutils.UtcNow()
+	model.DeletedAt = timeutils.UtcNow().Round(time.Second)
 	return nil
 }
 
diff --git a/pkg/logger/extern/syslog.go b/pkg/logger/extern/syslog.go
index 5d014d1000..accf1fe945 100644
--- a/pkg/logger/extern/syslog.go
+++ b/pkg/logger/extern/syslog.go
@@ -26,7 +26,7 @@ import (
 )
 
 var (
-	sysLog          *syslog.Writer
+	sysLog          ISyslogWriter
 	syslogWorkerMan *appsrv.SWorkerManager
 )
 
@@ -54,7 +54,7 @@ func InitSyslog(url string) error {
 	}
 
 	var err error
-	sysLog, err = syslog.Dial(proto, addr, syslog.LOG_ERR|syslog.LOG_INFO, tag)
+	sysLog, err = syslog.Dial(proto, addr, 0, tag)
 	if err != nil {
 		return errors.Wrap(err, "syslog.Dial")
 	}
diff --git a/pkg/logger/extern/utils.go b/pkg/logger/extern/utils.go
new file mode 100644
index 0000000000..4424ecec46
--- /dev/null
+++ b/pkg/logger/extern/utils.go
@@ -0,0 +1,34 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package extern
+
+import (
+	"strings"
+)
+
+type ISyslogWriter interface {
+	Alert(m string) error
+	Crit(m string) error
+	Debug(m string) error
+	Emerg(m string) error
+	Err(m string) error
+	Info(m string) error
+	Notice(m string) error
+	Warning(m string) error
+}
+
+func FormatMsg(msg string, sep, fill string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(msg, " ", fill), sep, fill)
+}
diff --git a/pkg/logger/models/actionlog.go b/pkg/logger/models/actionlog.go
index 62aa4ea025..7be0402f36 100644
--- a/pkg/logger/models/actionlog.go
+++ b/pkg/logger/models/actionlog.go
@@ -181,21 +181,30 @@ func (action *SActionlog) CustomizeCreate(ctx context.Context, userCred mcclient
 func (self *SActionlog) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) {
 	self.SOpsLog.PostCreate(ctx, userCred, ownerId, query, data)
 	parts := []string{}
-	parts = append(parts, "0003")
+	// 厂商代码
+	parts = append(parts, options.Options.SyslogVendorCode)
+	// 事件ID
 	parts = append(parts, fmt.Sprintf("%d", self.Id))
+	// 用户名
 	parts = append(parts, self.User)
+	// 模块类型
 	parts = append(parts, self.Service)
+	// 事件时间
 	parts = append(parts, timeutils.MysqlTime(self.OpsTime))
+	// 事件类型
 	parts = append(parts, self.Action)
 	succ := "success"
 	if !self.Success {
 		succ = "fail"
 	}
+	// 事件结果
 	parts = append(parts, succ)
+	// 事件描述
 	notes := fmt.Sprintf("%s %s %s(%s)", self.Action, self.ObjType, self.ObjName, self.ObjId)
 	if len(self.Notes) > 0 {
 		notes = fmt.Sprintf("%s: %s", notes, self.Notes)
 	}
+	notes = extern.FormatMsg(notes, options.Options.SyslogSeparator, options.Options.SyslogSepEscape)
 	parts = append(parts, notes)
 	kind := ""
 	switch self.Kind {
@@ -206,10 +215,11 @@ func (self *SActionlog) PostCreate(ctx context.Context, userCred mcclient.TokenC
 	case api.KindIllegal:
 		kind = "2"
 	}
+	// 行为类别
 	parts = append(parts, kind)
 	parts = append(parts, "")
 
-	msg := strings.Join(parts, "*|")
+	msg := strings.Join(parts, options.Options.SyslogSeparator)
 	if len(self.Severity) == 0 {
 		if self.Success {
 			extern.Info(msg)
diff --git a/pkg/logger/options/options.go b/pkg/logger/options/options.go
index 1f212e9a59..1dec2fd636 100644
--- a/pkg/logger/options/options.go
+++ b/pkg/logger/options/options.go
@@ -33,6 +33,10 @@ type SLoggerOptions struct {
 	AuditorRoleNames                   []string `help:"role names of auditor admin" default:"sys_adtadmin,domain_adtadmin"`
 	ActionLogExceedCount               int      `help:"trigger notification when action log exceed count" default:"-1"`
 	ActionLogExceedCountNotifyInterval string   `help:"trigger notification interval" default:"5m"`
+
+	SyslogVendorCode string `help:"vendor code of syslog" default:"0003"`
+	SyslogSeparator  string `help:"syslog message field separator" default:","`
+	SyslogSepEscape  string `help:"syslog message separate escape string" default:"+"`
 }
 
 var (