diff --git a/cmd/climc/shell/compute/secgroups.go b/cmd/climc/shell/compute/secgroups.go
index d32b010677..723736c729 100644
--- a/cmd/climc/shell/compute/secgroups.go
+++ b/cmd/climc/shell/compute/secgroups.go
@@ -34,4 +34,5 @@ func init() {
 	cmd.Perform("add-rule", &options.SecgroupsAddRuleOptions{})
 	cmd.Perform("change-owner", &options.SecgroupChangeOwnerOptions{})
 	cmd.Perform("import-rules", &options.SecgroupImportRulesOptions{})
+	cmd.PerformClass("clean", &options.SecgroupCleanOptions{})
 }
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index 2165b76635..d1148443e1 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -839,7 +839,7 @@ func (manager *SSecurityGroupManager) InitializeData() error {
 		}
 	}
 	guests := make([]SGuest, 0)
-	q := GuestManager.Query().Equals("hypervisor", api.HYPERVISOR_KVM).IsNullOrEmpty("secgrp_id")
+	q := GuestManager.Query().Equals("hypervisor", api.HYPERVISOR_KVM).IsNotEmpty("external_id").IsNullOrEmpty("secgrp_id")
 	err = db.FetchModelObjects(GuestManager, q, &guests)
 	if err != nil {
 		log.Errorf("fetch guests without secgroup fail %s", err)
@@ -851,36 +851,36 @@ func (manager *SSecurityGroupManager) InitializeData() error {
 			return nil
 		})
 	}
-	if options.Options.CleanUselessKvmSecurityGroup {
-		q := SecurityGroupManager.Query()
-		q = q.Filter(
-			sqlchemy.AND(
-				sqlchemy.Equals(q.Field("cloudregion_id"), api.DEFAULT_REGION_ID),
-				sqlchemy.NotEquals(q.Field("id"), api.SECGROUP_DEFAULT_ID),
-				sqlchemy.NotIn(q.Field("id"), GuestManager.Query("secgrp_id").IsNotNull("secgrp_id").SubQuery()),
-				sqlchemy.NotIn(q.Field("id"), GuestManager.Query("admin_secgrp_id").IsNotNull("admin_secgrp_id").SubQuery()),
-				sqlchemy.NotIn(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
-				sqlchemy.NotIn(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
-				sqlchemy.NotIn(q.Field("id"), DBInstanceSecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
-				sqlchemy.NotIn(q.Field("id"), ElasticcachesecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
-			),
-		)
-		secgroups := []SSecurityGroup{}
-		err := db.FetchModelObjects(SecurityGroupManager, q, &secgroups)
+	return nil
+}
+
+func (manager *SSecurityGroupManager) PerformClean(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
+	q := SecurityGroupManager.Query()
+	q = q.Filter(
+		sqlchemy.AND(
+			sqlchemy.Equals(q.Field("cloudregion_id"), api.DEFAULT_REGION_ID),
+			sqlchemy.NotEquals(q.Field("id"), api.SECGROUP_DEFAULT_ID),
+			sqlchemy.NotIn(q.Field("id"), GuestManager.Query("secgrp_id").IsNotNull("secgrp_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), GuestManager.Query("admin_secgrp_id").IsNotNull("admin_secgrp_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), DBInstanceSecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), ElasticcachesecgroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
+			sqlchemy.NotIn(q.Field("id"), LoadbalancerSecurityGroupManager.Query("secgroup_id").IsNotNull("secgroup_id").SubQuery()),
+		),
+	)
+	secgroups := []SSecurityGroup{}
+	err := db.FetchModelObjects(SecurityGroupManager, q, &secgroups)
+	if err != nil {
+		return nil, errors.Wrapf(err, "FetchModelObjects")
+	}
+	for i := range secgroups {
+		err = secgroups[i].RealDelete(ctx, userCred)
 		if err != nil {
-			return err
-		}
-		ctx := context.Background()
-		ctx = context.WithValue(ctx, "clean", "kvm security groups")
-		userCred := auth.GetAdminSession(ctx, options.Options.Region).GetToken()
-		for i := range secgroups {
-			err = secgroups[i].RealDelete(ctx, userCred)
-			if err != nil {
-				return err
-			}
+			return nil, errors.Wrapf(err, "delete %s", secgroups[i].Name)
 		}
 	}
-	return nil
+	return nil, nil
 }
 
 func (self *SSecurityGroup) GetRegionDriver() (IRegionDriver, error) {
diff --git a/pkg/compute/options/options.go b/pkg/compute/options/options.go
index 2acb832d89..83e25f8568 100644
--- a/pkg/compute/options/options.go
+++ b/pkg/compute/options/options.go
@@ -34,9 +34,8 @@ type ComputeOptions struct {
 	DefaultMemoryOvercommitBound  float32 `default:"1.0" help:"Default memory overcommit bound for host, default to 1"`
 	DefaultStorageOvercommitBound float32 `default:"1.0" help:"Default storage overcommit bound for storage, default to 1"`
 
-	DefaultSecurityGroupId       string `help:"Default security rules" default:"default"`
-	DefaultAdminSecurityGroupId  string `help:"Default admin security rules" default:""`
-	CleanUselessKvmSecurityGroup bool   `help:"Clean useless kvm security groups when service start"`
+	DefaultSecurityGroupId      string `help:"Default security rules" default:"default"`
+	DefaultAdminSecurityGroupId string `help:"Default admin security rules" default:""`
 
 	DefaultDiskSizeMB int `default:"10240" help:"Default disk size in MB if not specified, default to 10GiB" json:"default_disk_size"`
 
diff --git a/pkg/mcclient/options/compute/secgroup.go b/pkg/mcclient/options/compute/secgroup.go
index 021798b6c8..3df46e0714 100644
--- a/pkg/mcclient/options/compute/secgroup.go
+++ b/pkg/mcclient/options/compute/secgroup.go
@@ -180,3 +180,10 @@ func (opts *SecgroupImportRulesOptions) Params() (jsonutils.JSONObject, error) {
 	}
 	return jsonutils.Marshal(map[string]*jsonutils.JSONArray{"rules": rules}), nil
 }
+
+type SecgroupCleanOptions struct {
+}
+
+func (opts *SecgroupCleanOptions) Params() (jsonutils.JSONObject, error) {
+	return nil, nil
+}