diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
index c6fee20f66..0193c38ead 100644
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -10,6 +10,14 @@ import (
 	"strings"
 	"time"
 
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/util/billing"
+	"yunion.io/x/pkg/util/fileutils"
+	"yunion.io/x/pkg/util/regutils"
+	"yunion.io/x/pkg/utils"
+	"yunion.io/x/sqlchemy"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
@@ -22,14 +30,6 @@ import (
 	"yunion.io/x/onecloud/pkg/util/httputils"
 	"yunion.io/x/onecloud/pkg/util/logclient"
 	"yunion.io/x/onecloud/pkg/util/seclib2"
-
-	"yunion.io/x/jsonutils"
-	"yunion.io/x/log"
-	"yunion.io/x/onecloud/pkg/util/billing"
-	"yunion.io/x/pkg/util/fileutils"
-	"yunion.io/x/pkg/util/regutils"
-	"yunion.io/x/pkg/utils"
-	"yunion.io/x/sqlchemy"
 )
 
 func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
@@ -744,6 +744,7 @@ func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient
 	if err := self.revokeSecgroup(ctx, userCred, secgroup); err != nil {
 		return nil, err
 	}
+	logclient.AddActionLog(self, logclient.ACT_VM_REVOKESECGROUP, fmt.Sprintf("secgroup: %s", secgrpV.Model.GetName()), userCred, true)
 	return nil, self.StartSyncTask(ctx, userCred, true, "")
 }
 
@@ -763,6 +764,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient
 		return nil, err
 	}
 
+	logclient.AddActionLog(self, logclient.ACT_VM_ASSIGNSECGROUP, fmt.Sprintf("secgroup: %s", secgrpV.Model.GetName()), userCred, true)
 	return nil, self.StartSyncTask(ctx, userCred, true, "")
 }
 
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index 326d8d0dc5..79e6514678 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -243,8 +243,11 @@ func (self *SSecurityGroup) SyncWithCloudSecurityGroup(userCred mcclient.TokenCr
 
 func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCredential, extSec cloudprovider.ICloudSecurityGroup, vpc *SVpc, projectId string) (*SSecurityGroup, bool, error) {
 	if secgroup, exist := SecurityGroupCacheManager.CheckExist(context.Background(), userCred, extSec.GetGlobalId(), extSec.GetVpcId(), vpc.CloudregionId, vpc.ManagerId); exist {
+		if secgroup.GetGuestsCount() == 0 {
+			return secgroup, true, nil
+		}
 		//避免重复同步
-		return secgroup, true, nil
+		return secgroup, false, nil
 	}
 
 	secgroup := SSecurityGroup{}
@@ -258,7 +261,7 @@ func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCre
 	}
 
 	if err := manager.TableSpec().Insert(&secgroup); err != nil {
-		return nil, false, err
+		return nil, true, err
 	}
 
 	if secgroupcache := SecurityGroupCacheManager.Register(context.Background(), userCred, secgroup.Id, extSec.GetVpcId(), vpc.CloudregionId, vpc.ManagerId); secgroupcache != nil {
@@ -267,7 +270,7 @@ func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCre
 		}
 	}
 
-	return &secgroup, false, nil
+	return &secgroup, true, nil
 }
 
 func (manager *SSecurityGroupManager) SyncSecgroups(ctx context.Context, userCred mcclient.TokenCredential, secgroups []cloudprovider.ICloudSecurityGroup, vpc *SVpc, projectId string, projectSync bool) ([]SSecurityGroup, []cloudprovider.ICloudSecurityGroup, compare.SyncResult) {
@@ -311,18 +314,17 @@ func (manager *SSecurityGroupManager) SyncSecgroups(ctx context.Context, userCre
 			syncResult.AddError(err)
 			continue
 		}
-		new, exist, err := manager.newFromCloudVpc(userCred, added[i], vpc, projectId)
+		new, ruleSync, err := manager.newFromCloudVpc(userCred, added[i], vpc, projectId)
 		if err != nil {
 			syncResult.AddError(err)
 			continue
 		}
-		if exist {
-			continue
-		}
 		localSecgroups = append(localSecgroups, *new)
 		remoteSecgroups = append(remoteSecgroups, added[i])
-		SecurityGroupRuleManager.SyncRules(ctx, userCred, new, rules)
 		syncResult.Add()
+		if ruleSync {
+			SecurityGroupRuleManager.SyncRules(ctx, userCred, new, rules)
+		}
 	}
 	return localSecgroups, remoteSecgroups, syncResult
 }
diff --git a/pkg/util/logclient/logclient.go b/pkg/util/logclient/logclient.go
index f17997ff29..dc6a8a09fe 100644
--- a/pkg/util/logclient/logclient.go
+++ b/pkg/util/logclient/logclient.go
@@ -56,6 +56,7 @@ const (
 	ACT_VM_SYNC_STATUS               = "同步状态"
 	ACT_VM_UNBIND_KEYPAIR            = "解绑密钥"
 	ACT_VM_ASSIGNSECGROUP            = "关联安全组"
+	ACT_VM_REVOKESECGROUP            = "取消关联安全组"
 	ACT_RESET_DISK                   = "回滚磁盘"
 
 	ACT_RECYCLE_PREPAID      = "池化预付费主机"