diff --git a/platform/src/packet_io.cpp b/platform/src/packet_io.cpp
index b9a3657..12ca34c 100644
--- a/platform/src/packet_io.cpp
+++ b/platform/src/packet_io.cpp
@@ -641,7 +641,7 @@ static void action_sf_chaining(struct thread_ctx *thread_ctx, struct session_ctx
  * handle session status
  ******************************************************************************/
 
-static int send_event_log(struct session_ctx *session_ctx, struct selected_chaining *chaining, struct thread_ctx *thread_ctx)
+static int send_ctrl_packet(struct session_ctx *session_ctx, struct selected_chaining *chaining, struct thread_ctx *thread_ctx)
 {
     struct sce_ctx *sce_ctx = thread_ctx->ref_sce_ctx;
     struct packet_io *packet_io = thread_ctx->ref_io;
@@ -664,8 +664,8 @@ static int send_event_log(struct session_ctx *session_ctx, struct selected_chain
     mpack_write_u64(&writer, session_ctx->session_id);
 
     // state
-    // mpack_write_cstr(&writer, "state");
-    // mpack_write_cstr(&writer, "closed");
+    mpack_write_cstr(&writer, "state");
+    mpack_write_cstr(&writer, "active");
 
     // method
     mpack_write_cstr(&writer, "method");
@@ -738,7 +738,38 @@ static int send_event_log(struct session_ctx *session_ctx, struct selected_chain
     return nsend;
 }
 
-static void dump_event_log(struct session_ctx *session_ctx, struct selected_chaining *chaining, const char *tag)
+static void send_event_log(struct session_ctx *session_ctx, struct thread_ctx *thread_ctx)
+{
+    int nsend = 0;
+    struct sce_ctx *sce_ctx = thread_ctx->ref_sce_ctx;
+    struct global_metrics *g_metrics = thread_ctx->ref_metrics;
+    struct selected_chaining *chaining_raw = session_ctx->chainings.chaining_raw;
+    struct selected_chaining *chaining_decrypted = session_ctx->chainings.chaining_decrypted;
+
+    if (chaining_raw->chaining_used && sce_ctx->enable_send_log)
+    {
+        nsend = send_ctrl_packet(session_ctx, chaining_raw, thread_ctx);
+        if (nsend > 0)
+        {
+            ATOMIC_INC(&(g_metrics->sf_session.log));
+            throughput_metrics_inc(&(g_metrics->ctrl_pkt.tx), 1, nsend);
+            throughput_metrics_inc(&(g_metrics->device.nf_tx), 1, nsend);
+        }
+    }
+
+    if (chaining_decrypted->chaining_used && sce_ctx->enable_send_log)
+    {
+        nsend = send_ctrl_packet(session_ctx, chaining_decrypted, thread_ctx);
+        if (nsend > 0)
+        {
+            ATOMIC_INC(&(g_metrics->sf_session.log));
+            throughput_metrics_inc(&(g_metrics->ctrl_pkt.tx), 1, nsend);
+            throughput_metrics_inc(&(g_metrics->device.nf_tx), 1, nsend);
+        }
+    }
+}
+
+static void dump_sf_metrics(struct session_ctx *session_ctx, struct selected_chaining *chaining, const char *tag)
 {
     if (chaining == NULL)
     {
@@ -748,7 +779,7 @@ static void dump_event_log(struct session_ctx *session_ctx, struct selected_chai
     for (int i = 0; i < chaining->chaining_used; i++)
     {
         struct selected_sf *sf = &(chaining->chaining[i]);
-        LOG_INFO("%s: session %lu %s %s metrics log: rule_id %lu sff_profile_id %d sf_profile_id %d sf_need_skip %d sf_action_reason %s rx_pkts %lu rx_bytes %lu tx_pkts %lu tx_bytes %lu",
+        LOG_INFO("%s: session %lu %s %s metrics: rule_id %lu sff_profile_id %d sf_profile_id %d sf_need_skip %d sf_action_reason %s rx_pkts %lu rx_bytes %lu tx_pkts %lu tx_bytes %lu",
                  LOG_TAG_METRICS, session_ctx->session_id, session_ctx->session_addr, tag, sf->rule_id, sf->sff_profile_id, sf->sf_profile_id, sf->sf_need_skip, action_reason_to_string(sf->sf_action_reason), sf->rx.n_pkts, sf->rx.n_bytes, sf->tx.n_pkts, sf->tx.n_bytes);
     }
 }
@@ -818,6 +849,7 @@ static void handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
 
     LOG_INFO("%s: session %lu %s active first", LOG_TAG_PKTIO, session_ctx->session_id, session_ctx->session_addr);
     handle_policy_mutil_hits(enforcer, session_ctx, ctrl_parser, &raw_parser, meta->is_e2i_dir);
+    send_event_log(session_ctx, thread_ctx);
 
     session_table_insert(session_table, session_ctx->session_id, &session_ctx->inner_tuple4, session_ctx, session_value_free_cb);
     ATOMIC_INC(&(g_metrics->sf_session.num));
@@ -827,8 +859,6 @@ static void handle_session_closing(struct metadata *meta, struct ctrl_pkt_parser
 {
     struct global_metrics *g_metrics = thread_ctx->ref_metrics;
     struct session_table *session_table = thread_ctx->session_table;
-    struct sce_ctx *sce_ctx = thread_ctx->ref_sce_ctx;
-    int nsend = 0;
 
     struct session_node *node = session_table_search_by_id(session_table, meta->session_id);
     if (node)
@@ -837,30 +867,10 @@ static void handle_session_closing(struct metadata *meta, struct ctrl_pkt_parser
         LOG_INFO("%s: session %lu %s closing", LOG_TAG_PKTIO, s_ctx->session_id, s_ctx->session_addr);
 
         struct selected_chaining *chaining_raw = s_ctx->chainings.chaining_raw;
-        dump_event_log(s_ctx, chaining_raw, "raw_traffic");
-        if (chaining_raw->chaining_used && sce_ctx->enable_send_log)
-        {
-            nsend = send_event_log(s_ctx, chaining_raw, thread_ctx);
-            if (nsend > 0)
-            {
-                ATOMIC_INC(&(g_metrics->sf_session.log));
-                throughput_metrics_inc(&(g_metrics->ctrl_pkt.tx), 1, nsend);
-                throughput_metrics_inc(&(g_metrics->device.nf_tx), 1, nsend);
-            }
-        }
+        dump_sf_metrics(s_ctx, chaining_raw, "raw_traffic");
 
         struct selected_chaining *chaining_decrypted = s_ctx->chainings.chaining_decrypted;
-        dump_event_log(s_ctx, chaining_decrypted, "decrypted_traffic");
-        if (chaining_decrypted->chaining_used && sce_ctx->enable_send_log)
-        {
-            nsend = send_event_log(s_ctx, chaining_decrypted, thread_ctx);
-            if (nsend > 0)
-            {
-                ATOMIC_INC(&(g_metrics->sf_session.log));
-                throughput_metrics_inc(&(g_metrics->ctrl_pkt.tx), 1, nsend);
-                throughput_metrics_inc(&(g_metrics->device.nf_tx), 1, nsend);
-            }
-        }
+        dump_sf_metrics(s_ctx, chaining_decrypted, "decrypted_traffic");
 
         session_table_delete_by_id(session_table, meta->session_id);
         ATOMIC_DEC(&(g_metrics->sf_session.num));
@@ -888,6 +898,7 @@ static void handle_session_active(struct metadata *meta, struct ctrl_pkt_parser
 
         LOG_INFO("%s: session %lu %s active again", LOG_TAG_PKTIO, session_ctx->session_id, session_ctx->session_addr);
         handle_policy_mutil_hits(enforcer, session_ctx, ctrl_parser, &raw_parser, meta->is_e2i_dir);
+        send_event_log(session_ctx, thread_ctx);
     }
     else
     {