diff --git a/plugin/business/pangu-http/src/pangu_http.cpp b/plugin/business/pangu-http/src/pangu_http.cpp
index d3c02f0..9846acc 100644
--- a/plugin/business/pangu-http/src/pangu_http.cpp
+++ b/plugin/business/pangu-http/src/pangu_http.cpp
@@ -2464,7 +2464,7 @@ void pangu_on_http_end(const struct tfe_stream * stream,
 		}
 	}
 	struct pangu_log log_msg =  {.stream=stream, .http=session, .result=ctx->enforce_rules, .result_num=ctx->n_enforce,
-								.req_body= ctx->log_req_body, .resp_body=ctx->log_resp_body, .action=5};
+								.req_body= ctx->log_req_body, .resp_body=ctx->log_resp_body, .action=0};
 
 	if(ctx->action == PG_ACTION_MANIPULATE)
 	{
diff --git a/plugin/business/pangu-http/src/pangu_logger.cpp b/plugin/business/pangu-http/src/pangu_logger.cpp
index 78a430c..f3051ba 100644
--- a/plugin/business/pangu-http/src/pangu_logger.cpp
+++ b/plugin/business/pangu-http/src/pangu_logger.cpp
@@ -49,6 +49,20 @@ struct pangu_logger
 	struct cache_evbase_instance * log_file_upload_instance;
 };
 
+enum _log_action //Bigger action number is prior.
+{
+	LG_ACTION_NONE = 0x00,
+	LG_ACTION_MONIT = 0x01,
+	LG_ACTION_FORWARD = 0x02,    /* N/A */
+	LG_ACTION_REJECT = 0x10,
+	LG_ACTION_DROP = 0x20,    /* N/A */
+	LG_ACTION_MANIPULATE = 0x30,
+	LG_ACTION_RATELIMIT = 0x40,    /* N/A */
+	LG_ACTION_LOOP = 0x60,    /* N/A */
+	LG_ACTION_WHITELIST = 0x80,
+	__LG_ACTION_MAX
+};
+
 static unsigned int get_ip_by_eth_name(const char *ifname)
 {
     int sockfd;
@@ -191,7 +205,12 @@ int pangu_send_log(struct pangu_logger* handle, const struct pangu_log* log_msg)
 
 	const char *app_proto[]= {"unkonw","http1", "http2"};
 
-	const char *clue_action_map[]= {"redirect","block","replace","hijack","insert"};
+	const char *manipulate_action_map[]= {"redirect","block","replace","hijack","insert"};
+
+	const char *panggu_action_map[__LG_ACTION_MAX];
+	panggu_action_map[LG_ACTION_MONIT]="monitor";
+	panggu_action_map[LG_ACTION_REJECT]="deny";
+	panggu_action_map[LG_ACTION_WHITELIST]="allow";
 
 	struct json_spec req_fields[]={	{"http_cookie", TFE_HTTP_COOKIE},
 									{"http_referer", TFE_HTTP_REFERER},
@@ -365,11 +384,16 @@ int pangu_send_log(struct pangu_logger* handle, const struct pangu_log* log_msg)
 		per_hit_obj=cJSON_Duplicate(common_obj, 1);
 		cJSON_AddNumberToObject(per_hit_obj, "common_policy_id", log_msg->result[i].config_id);
 		cJSON_AddNumberToObject(per_hit_obj, "common_service", log_msg->result[i].service_id);
-		cJSON_AddNumberToObject(per_hit_obj, "common_action", (unsigned char)log_msg->result[i].action);
-		if(log_msg->action<5)
+		cJSON_AddNumberToObject(per_hit_obj, "common_action", LG_ACTION_MANIPULATE);
+		if(log_msg->result[i].action == LG_ACTION_MANIPULATE)
 		{
-			cJSON_AddStringToObject(per_hit_obj, "common_sub_action", clue_action_map[log_msg->action]);
+			cJSON_AddStringToObject(per_hit_obj, "common_sub_action", manipulate_action_map[log_msg->action]);
 		}
+		else
+		{
+			cJSON_AddStringToObject(per_hit_obj, "common_sub_action", panggu_action_map[(unsigned char)(log_msg->result[i].action)]);
+		}
+
 		log_payload = cJSON_PrintUnformatted(per_hit_obj);
 
 		TFE_LOG_DEBUG(handle->local_logger, "%s", log_payload);