diff --git a/inc/tsg_label.h b/inc/tsg_label.h
index a88a2a9..4502a99 100644
--- a/inc/tsg_label.h
+++ b/inc/tsg_label.h
@@ -4,6 +4,9 @@
 #define	MAX_CATEGORY_ID_NUM	8
 #define	MAX_STR_FIELD_LEN	64
 
+#define	MAX_RESULT_NUM	8
+#define	MAX_DOAMIN_LEN	2048
+
 typedef enum _tsg_protocol
 {
    PROTO_UNKONWN=0,
@@ -83,4 +86,14 @@ struct _session_attribute_label_t
 	unsigned int fqdn_category_id[MAX_CATEGORY_ID_NUM];
 };
 
+typedef	struct _policy_priority_label
+{
+	tsg_protocol_t proto;	//enum _tsg_protocol (tsg_types.h)
+	int domain_len;
+	int result_type;	//enum _PULL_RESULT_TYPE (tsg_rule.h)
+	int result_num;
+	char domain[MAX_DOAMIN_LEN];
+	Maat_rule_t result[MAX_RESULT_NUM];
+}policy_priority_label_t;
+
 #endif
diff --git a/inc/tsg_rule.h b/inc/tsg_rule.h
index f6db9fd..5e19849 100644
--- a/inc/tsg_rule.h
+++ b/inc/tsg_rule.h
@@ -24,9 +24,6 @@ enum TSG_ETHOD_TYPE
 	TSG_METHOD_TYPE_MAX
 };
 
-#define	MAX_RESULT_NUM	8
-#define	MAX_DOAMIN_LEN	2048
-
 struct _identify_info
 {
 	tsg_protocol_t proto;	//enum _tsg_protocol (tsg_types.h)
diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp
index 8b1b0f5..943af77 100644
--- a/src/tsg_entry.cpp
+++ b/src/tsg_entry.cpp
@@ -708,6 +708,8 @@ extern "C" char TSG_MASTER_TCP_ENTRY(struct streaminfo *a_tcp, void **pme, int t
 	policy_priority_label_t *priority_label=NULL;	
 	struct _master_context *_context=(struct _master_context *)*pme;
 	struct _session_attribute_label_t *internal_label=NULL;
+	unsigned long long create_time=0;
+	int size=sizeof(create_time);
 	switch(a_tcp->opstate)
 	{
 		case	OP_STATE_PENDING:
@@ -720,12 +722,13 @@ extern "C" char TSG_MASTER_TCP_ENTRY(struct streaminfo *a_tcp, void **pme, int t
 			identify_application_protocol(a_tcp, &identify_info, internal_label, a_packet);
 			internal_label->proto=identify_info.proto;
 
-			if(identify_info.proto==PROTO_HTTP)
+			ret=MESA_get_stream_opt(a_tcp, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size);
+			if(ret>=0)
 			{
 				clock_gettime(CLOCK_REALTIME, &tv);
-				internal_label->establish_latency_ms=(tv.tv_sec-a_tcp->ptcpdetail->createtime)*1000+tv.tv_nsec/1000/1000;
+				internal_label->establish_latency_ms=tv.tv_sec*1000+tv.tv_nsec/1000/1000 - create_time;
 			}
-			
+
 			ret=project_req_add_struct(a_tcp, g_tsg_para.internal_project_id, (const void *)internal_label);
 			if(ret<0)
 			{
diff --git a/src/tsg_entry.h b/src/tsg_entry.h
index 76bb044..c5855e6 100644
--- a/src/tsg_entry.h
+++ b/src/tsg_entry.h
@@ -80,17 +80,6 @@ struct _fqdn_category_t
 	char fqdn[MAX_DOAMIN_LEN/8];
 };
 
-
-typedef	struct _policy_priority_label
-{
-	tsg_protocol_t proto;	//enum _tsg_protocol (tsg_types.h)
-	int domain_len;
-	int result_type;	//enum _PULL_RESULT_TYPE (tsg_rule.h)
-	int result_num;
-	char domain[MAX_DOAMIN_LEN];
-	Maat_rule_t result[MAX_RESULT_NUM];
-}policy_priority_label_t;
-
 struct _master_context
 {
 	tsg_protocol_t proto;
diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp
index e2543e6..507796d 100644
--- a/src/tsg_send_log.cpp
+++ b/src/tsg_send_log.cpp
@@ -317,8 +317,10 @@ int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle
 	unsigned short tunnel_type=0;
 	char nest_addr_buf[1024];
 	char *addr_proto=NULL;
-	time_t cur_time;
+	struct timespec tv;
+	int size=sizeof(unsigned long long);
 	long common_con_duration_ms=0;
+	unsigned long long create_time=0;
 	unsigned long long stream_id=0;
 	unsigned short c_port=0, s_port=0;
 	int tunnel_type_size=sizeof(tunnel_type);
@@ -407,13 +409,22 @@ int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle
 	{
 		TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)(a_stream->ptcpdetail->createtime), TLD_TYPE_LONG);
 		TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)(a_stream->ptcpdetail->lastmtime), TLD_TYPE_LONG);
+
+		ret=MESA_get_stream_opt(a_stream, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size);
+		if(ret>=0)
+		{
+			clock_gettime(CLOCK_REALTIME, &tv);
+			common_con_duration_ms=tv.tv_sec*1000+tv.tv_nsec/1000/1000 - create_time;
+		}
 		
-		common_con_duration_ms=(a_stream->ptcpdetail->lastmtime-a_stream->ptcpdetail->createtime)*1000;
-		TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG);
+		if(common_con_duration_ms>0)
+		{
+			TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG);
+		}
 	}
 	else
 	{
-		cur_time=time(NULL);
+		time_t cur_time=time(NULL);
 		TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)cur_time, TLD_TYPE_LONG);
 		TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)cur_time, TLD_TYPE_LONG);		
 		TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG);