diff --git a/server/admin/api_set_audit.go b/server/admin/api_set_audit.go
index 872c7a6..1b423e8 100644
--- a/server/admin/api_set_audit.go
+++ b/server/admin/api_set_audit.go
@@ -51,3 +51,29 @@ func SetAuditExport(w http.ResponseWriter, r *http.Request) {
 	gocsv.Marshal(datas, w)
 
 }
+
+func UserActLogList(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	pageS := r.FormValue("page")
+	page, _ := strconv.Atoi(pageS)
+	if page < 1 {
+		page = 1
+	}
+	var datas []dbdata.UserActLog
+	session := dbdata.UserActLogIns.GetSession(r.Form)
+	count, err := dbdata.FindAndCount(session, &datas, dbdata.PageSize, page)
+	if err != nil && !dbdata.CheckErrNotFound(err) {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	data := map[string]interface{}{
+		"count":     count,
+		"page_size": dbdata.PageSize,
+		"datas":     datas,
+		"statusOps": dbdata.UserActLogIns.GetStatusOpsWithTag(),
+		"osOps":     dbdata.UserActLogIns.OsOps,
+		"clientOps": dbdata.UserActLogIns.ClientOps,
+	}
+
+	RespSucess(w, data)
+}
diff --git a/server/admin/api_user.go b/server/admin/api_user.go
index 62f80ac..392b8d3 100644
--- a/server/admin/api_user.go
+++ b/server/admin/api_user.go
@@ -178,7 +178,7 @@ func UserOnline(w http.ResponseWriter, r *http.Request) {
 func UserOffline(w http.ResponseWriter, r *http.Request) {
 	_ = r.ParseForm()
 	token := r.FormValue("token")
-	sessdata.CloseSess(token)
+	sessdata.CloseSess(token, 4)
 	RespSucess(w, nil)
 }
 
diff --git a/server/admin/api_user_act.go b/server/admin/api_user_act.go
deleted file mode 100644
index fc29498..0000000
--- a/server/admin/api_user_act.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package admin
-
-import (
-	"net/http"
-	"strconv"
-
-	"github.com/bjdgyc/anylink/dbdata"
-)
-
-func UserActLogList(w http.ResponseWriter, r *http.Request) {
-	_ = r.ParseForm()
-	pageS := r.FormValue("page")
-	page, _ := strconv.Atoi(pageS)
-	if page < 1 {
-		page = 1
-	}
-	var datas []dbdata.UserActLog
-	session := dbdata.UserActLogIns.GetSession(r.Form)
-	count, err := dbdata.FindAndCount(session, &datas, dbdata.PageSize, page)
-	if err != nil && !dbdata.CheckErrNotFound(err) {
-		RespError(w, RespInternalErr, err)
-		return
-	}
-	data := map[string]interface{}{
-		"count":     count,
-		"page_size": dbdata.PageSize,
-		"datas":     datas,
-		"statusOps": dbdata.UserActLogIns.GetStatusOpsWithTag(),
-		"osOps":     dbdata.UserActLogIns.OsOps,
-		"clientOps": dbdata.UserActLogIns.ClientOps,
-	}
-
-	RespSucess(w, data)
-}
diff --git a/server/admin/server.go b/server/admin/server.go
index 5230096..2f0bae0 100644
--- a/server/admin/server.go
+++ b/server/admin/server.go
@@ -45,6 +45,7 @@ func StartAdmin() {
 	r.HandleFunc("/set/other/audit_log/edit", SetOtherAuditLogEdit)
 	r.HandleFunc("/set/audit/list", SetAuditList)
 	r.HandleFunc("/set/audit/export", SetAuditExport)
+	r.HandleFunc("/set/audit/act_log_list", UserActLogList)
 
 	r.HandleFunc("/user/list", UserList)
 	r.HandleFunc("/user/detail", UserDetail)
@@ -63,7 +64,6 @@ func StartAdmin() {
 	r.HandleFunc("/user/policy/detail", PolicyDetail)
 	r.HandleFunc("/user/policy/set", PolicySet)
 	r.HandleFunc("/user/policy/del", PolicyDel)
-	r.HandleFunc("/user/act_log/list", UserActLogList)
 
 	r.HandleFunc("/group/list", GroupList)
 	r.HandleFunc("/group/names", GroupNames)
diff --git a/server/dbdata/user_act_log.go b/server/dbdata/user_act_log.go
index a7032dd..c3f4ce2 100644
--- a/server/dbdata/user_act_log.go
+++ b/server/dbdata/user_act_log.go
@@ -11,10 +11,16 @@ import (
 )
 
 const (
-	UserAuthFail    = 0 // 认证失败
-	UserAuthSuccess = 1 // 认证成功
-	UserConnected   = 2 // 连线成功
-	UserLogout      = 3 // 用户登出
+	UserAuthFail      = 0 // 认证失败
+	UserAuthSuccess   = 1 // 认证成功
+	UserConnected     = 2 // 连线成功
+	UserLogout        = 3 // 用户登出
+	UserLogoutLose    = 0 // 用户掉线
+	UserLogoutBanner  = 1 // 用户banner弹窗取消
+	UserLogoutClient  = 2 // 用户主动登出
+	UserLogoutTimeout = 3 // 用户超时登出
+	UserLogoutAdmin   = 4 // 账号被管理员踢下线
+	UserLogoutExpire  = 5 // 账号过期被踢下线
 )
 
 type UserActLogProcess struct {
@@ -48,9 +54,12 @@ var (
 			2: "Unknown",
 		},
 		InfoOps: []string{ // 信息
-			0: "用户掉线",
-			1: "用户/客户端主动断开",
-			2: "用户被踢下线(管理员/账号过期)",
+			UserLogoutLose:    "用户掉线",
+			UserLogoutBanner:  "用户取消弹窗",
+			UserLogoutClient:  "用户/客户端主动断开",
+			UserLogoutTimeout: "Session过期被踢下线",
+			UserLogoutAdmin:   "账号被管理员踢下线",
+			UserLogoutExpire:  "账号过期被踢下线",
 		},
 	}
 )
@@ -104,8 +113,7 @@ func (ua *UserActLogProcess) GetStatusOpsWithTag() interface{} {
 }
 
 func (ua *UserActLogProcess) GetInfoOpsById(id uint8) string {
-	infoMap := ua.InfoOps
-	return infoMap[id]
+	return ua.InfoOps[id]
 }
 
 func (ua *UserActLogProcess) ParseUserAgent(userAgent string) (os_idx, client_idx uint8, ver string) {
diff --git a/server/handler/link_auth.go b/server/handler/link_auth.go
index 279f6f5..698f4b2 100644
--- a/server/handler/link_auth.go
+++ b/server/handler/link_auth.go
@@ -43,7 +43,6 @@ func LinkAuth(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// fmt.Printf("%+v \n", cr)
-
 	setCommonHeader(w)
 	if cr.Type == "logout" {
 		// 退出删除session信息
@@ -100,6 +99,8 @@ func LinkAuth(w http.ResponseWriter, r *http.Request) {
 	sess.Group = cr.GroupSelect
 	sess.MacAddr = strings.ToLower(cr.MacAddressList.MacAddress)
 	sess.UniqueIdGlobal = cr.DeviceId.UniqueIdGlobal
+	sess.UserAgent = userAgent
+	sess.RemoteAddr = r.RemoteAddr
 	// 获取客户端mac地址
 	macHw, err := net.ParseMAC(sess.MacAddr)
 	if err != nil {
diff --git a/server/handler/link_cstp.go b/server/handler/link_cstp.go
index 29be380..0275c16 100644
--- a/server/handler/link_cstp.go
+++ b/server/handler/link_cstp.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
 	"github.com/bjdgyc/anylink/pkg/utils"
 	"github.com/bjdgyc/anylink/sessdata"
 )
@@ -55,7 +56,7 @@ func LinkCstp(conn net.Conn, bufRW *bufio.ReadWriter, cSess *sessdata.ConnSessio
 			// do nothing
 			// base.Debug("recv keepalive", cSess.IpAddr)
 		case 0x05: // DISCONNECT
-			cSess.UserDisconnect = true
+			cSess.UserLogoutCode = dbdata.UserLogoutClient
 			base.Debug("DISCONNECT", cSess.IpAddr)
 			return
 		case 0x03: // DPD-REQ
diff --git a/server/handler/link_dtls.go b/server/handler/link_dtls.go
index 7477127..4a88b8a 100644
--- a/server/handler/link_dtls.go
+++ b/server/handler/link_dtls.go
@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
 	"github.com/bjdgyc/anylink/pkg/utils"
 	"github.com/bjdgyc/anylink/sessdata"
 )
@@ -57,7 +58,7 @@ func LinkDtls(conn net.Conn, cSess *sessdata.ConnSession) {
 			// do nothing
 			// base.Debug("recv keepalive", cSess.IpAddr)
 		case 0x05: // DISCONNECT
-			cSess.UserDisconnect = true
+			cSess.UserLogoutCode = dbdata.UserLogoutClient
 			base.Debug("DISCONNECT DTLS", cSess.IpAddr)
 			return
 		case 0x03: // DPD-REQ
diff --git a/server/sessdata/session.go b/server/sessdata/session.go
index 69ac1ec..4638f9b 100644
--- a/server/sessdata/session.go
+++ b/server/sessdata/session.go
@@ -37,8 +37,7 @@ type ConnSession struct {
 	IfName              string
 	Client              string // 客户端  mobile pc
 	UserAgent           string // 客户端信息
-	UserDisconnect      bool   // 用户/客户端主动登出
-	UserKickout         bool   // 被踢下线
+	UserLogoutCode      uint8  // 用户/客户端主动登出
 	CstpDpd             int
 	Group               *dbdata.Group
 	Limit               *LimitRater
@@ -76,6 +75,8 @@ type Session struct {
 	Group          string
 	AuthStep       string
 	AuthPass       string
+	RemoteAddr     string
+	UserAgent      string
 
 	LastLogin time.Time
 	IsActive  bool
@@ -113,7 +114,7 @@ func checkSession() {
 
 			// 删除过期session
 			for _, v := range outToken {
-				CloseSess(v)
+				CloseSess(v, dbdata.UserLogoutTimeout)
 			}
 		}
 	}()
@@ -133,7 +134,7 @@ func CloseUserLimittimeSession() {
 	}
 	sessMux.RUnlock()
 	for _, v := range limitTimeToken {
-		CloseSess(v)
+		CloseSess(v, dbdata.UserLogoutExpire)
 	}
 }
 
@@ -411,7 +412,7 @@ func DelSess(token string) {
 	// sessions.Delete(token)
 }
 
-func CloseSess(token string) {
+func CloseSess(token string, code ...uint8) {
 	sessMux.Lock()
 	defer sessMux.Unlock()
 	sess, ok := sessions[token]
@@ -421,8 +422,15 @@ func CloseSess(token string) {
 
 	delete(sessions, token)
 	delete(dtlsIds, sess.DtlsSid)
-  sess.CSess.UserKickout = true
-	sess.CSess.Close()
+
+	if sess.CSess != nil {
+		if len(code) > 0 {
+			sess.CSess.UserLogoutCode = code[0]
+		}
+		sess.CSess.Close()
+		return
+	}
+	AddUserActLogBySess(sess)
 }
 
 func CloseCSess(token string) {
@@ -433,14 +441,16 @@ func CloseCSess(token string) {
 		return
 	}
 
-	sess.CSess.Close()
+	if sess.CSess != nil {
+		sess.CSess.Close()
+	}
 }
 
 func DelSessByStoken(stoken string) {
 	stoken = strings.TrimSpace(stoken)
 	sarr := strings.Split(stoken, "@")
 	token := sarr[1]
-	CloseSess(token)
+	CloseSess(token, dbdata.UserLogoutBanner)
 }
 
 func AddUserActLog(cs *ConnSession) {
@@ -451,13 +461,18 @@ func AddUserActLog(cs *ConnSession) {
 		RemoteAddr: cs.RemoteAddr,
 		Status:     dbdata.UserLogout,
 	}
-	infoId := uint8(0)
-	switch {
-	case cs.UserDisconnect:
-		infoId = 1
-	case cs.UserKickout:
-		infoId = 2
-	}
-	ua.Info = dbdata.UserActLogIns.GetInfoOpsById(infoId)
+	ua.Info = dbdata.UserActLogIns.GetInfoOpsById(cs.UserLogoutCode)
 	dbdata.UserActLogIns.Add(ua, cs.UserAgent)
 }
+
+func AddUserActLogBySess(sess *Session) {
+	ua := dbdata.UserActLog{
+		Username:   sess.Username,
+		GroupName:  sess.Group,
+		IpAddr:     "",
+		RemoteAddr: sess.RemoteAddr,
+		Status:     dbdata.UserLogout,
+	}
+	ua.Info = dbdata.UserActLogIns.GetInfoOpsById(1)
+	dbdata.UserActLogIns.Add(ua, sess.UserAgent)
+}
diff --git a/web/src/components/audit/ActLog.vue b/web/src/components/audit/ActLog.vue
index 5a18c0d..0f1f4fc 100644
--- a/web/src/components/audit/ActLog.vue
+++ b/web/src/components/audit/ActLog.vue
@@ -193,7 +193,7 @@ export default {
     getData(page) {
       console.log(this.searchForm)
       this.page = page
-      axios.get('/user/act_log/list', {
+      axios.get('/set/audit/act_log_list', {
         params: {
           page: page,
           username: this.searchForm.username || '',