diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index 1daca7b8a3875c55eb51735d779ee54c272b7b45..6981c16e9e1a5faf62453c56e454f4839fa45c43 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -481,7 +481,18 @@ void *tscProcessMsgFromServer(char *msg, void *ahandle, void *thandle) {
       msg = NULL;
     } else if (rspCode == TSDB_CODE_NOT_ACTIVE_TABLE || rspCode == TSDB_CODE_INVALID_TABLE_ID ||
         rspCode == TSDB_CODE_INVALID_VNODE_ID || rspCode == TSDB_CODE_NOT_ACTIVE_VNODE ||
-        rspCode == TSDB_CODE_NETWORK_UNAVAIL) {
+        rspCode == TSDB_CODE_NETWORK_UNAVAIL || rspCode == TSDB_CODE_NOT_ACTIVE_SESSION) {
+      /*
+       * not_active_table: 1. the virtual node may fail to create table, since the procedure of create table is asynchronized,
+       *                   the virtual node may have not create table till now, so try again by using the new metermeta.
+       *                   2. this requested table may have been removed by other client, so we need to renew the
+       *                   metermeta here.
+       *
+       * not_active_vnode: current vnode is move to other node due to node balance procedure or virtual node have been
+       *                   removed. So, renew metermeta and try again.
+       * not_active_session: db has been move to other node, the vnode does not exist on this dnode anymore.
+       */
+
 #else
      if (rspCode == TSDB_CODE_NOT_ACTIVE_TABLE || rspCode == TSDB_CODE_INVALID_TABLE_ID ||
         rspCode == TSDB_CODE_INVALID_VNODE_ID || rspCode == TSDB_CODE_NOT_ACTIVE_VNODE ||
diff --git a/src/rpc/src/trpc.c b/src/rpc/src/trpc.c
index 9f006ab05a9612a1ca2f6f8e3e790156938bf423..6f32c5488851a0682cc0c8b74c91ec161dc4c397 100755
--- a/src/rpc/src/trpc.c
+++ b/src/rpc/src/trpc.c
@@ -899,7 +899,10 @@ int taosProcessMsgHeader(STaosHeader *pHeader, SRpcConn **ppConn, STaosRpc *pSer
       }
 
       if (taosAuthenticateMsg((uint8_t *)pHeader, dataLen - TSDB_AUTH_LEN, pDigest->auth, pConn->secret) < 0) {
-        tTrace("%s cid:%d sid:%d id:%s, authentication failed, msg discarded pConn:%p", pServer->label, chann, sid,
+        char ipstr[24];
+        tinet_ntoa(ipstr, ip);
+        mLError("user:%s login from %s, authentication failed", pHeader->meterId, ipstr);
+        tError("%s cid:%d sid:%d id:%s, authentication failed, msg discarded pConn:%p", pServer->label, chann, sid,
                pConn->meterId, pConn);
         code = TSDB_CODE_AUTH_FAILURE;
         goto _exit;
diff --git a/src/system/detail/src/mgmtDb.c b/src/system/detail/src/mgmtDb.c
index f7ccdfc3a547589b7d6cd352701e074fbaa14fff..c8c8ed1bb8b0a205dadfe36994518ec3c213f813 100644
--- a/src/system/detail/src/mgmtDb.c
+++ b/src/system/detail/src/mgmtDb.c
@@ -668,6 +668,11 @@ int mgmtRetrieveDbs(SShowObj *pShow, char *data, int rows, SConnObj *pConn) {
     pDb = (SDbObj *)pShow->pNode;
     if (pDb == NULL) break;
     pShow->pNode = (void *)pDb->next;
+    if (mgmtCheckIsMonitorDB(pDb->name, tsMonitorDbName)) {
+      if (strcmp(pConn->pUser->user, "root") != 0 && strcmp(pConn->pUser->user, "_root") != 0 && strcmp(pConn->pUser->user, "monitor") != 0 ) {
+        continue;
+      }
+    }
 
     cols = 0;
 
diff --git a/src/system/detail/src/mgmtMeter.c b/src/system/detail/src/mgmtMeter.c
index 4e1d62e60e4e01a30d67e99634b1ebe481dd3fe4..7a2cdabea5df06eda58c302d0883e59418ec8768 100644
--- a/src/system/detail/src/mgmtMeter.c
+++ b/src/system/detail/src/mgmtMeter.c
@@ -1259,6 +1259,11 @@ int mgmtRetrieveMeters(SShowObj *pShow, char *data, int rows, SConnObj *pConn) {
   if (pConn->pDb != NULL) pDb = mgmtGetDb(pConn->pDb->name);
 
   if (pDb == NULL) return 0;
+  if (mgmtCheckIsMonitorDB(pDb->name, tsMonitorDbName)) {
+    if (strcmp(pConn->pUser->user, "root") != 0 && strcmp(pConn->pUser->user, "_root") != 0 && strcmp(pConn->pUser->user, "monitor") != 0 ) {
+      return 0;
+    }
+  }
 
   strcpy(prefix, pDb->name);
   strcat(prefix, TS_PATH_DELIMITER);
@@ -1376,6 +1381,16 @@ int mgmtRetrieveMetrics(SShowObj *pShow, char *data, int rows, SConnObj *pConn)
   char *   pWrite;
   int      cols = 0;
 
+  SDbObj *pDb = NULL;
+  if (pConn->pDb != NULL) pDb = mgmtGetDb(pConn->pDb->name);
+
+  if (pDb == NULL) return 0;
+  if (mgmtCheckIsMonitorDB(pDb->name, tsMonitorDbName)) {
+    if (strcmp(pConn->pUser->user, "root") != 0 && strcmp(pConn->pUser->user, "_root") != 0 && strcmp(pConn->pUser->user, "monitor") != 0 ) {
+      return 0;
+    }
+  }
+
   SPatternCompareInfo info = PATTERN_COMPARE_INFO_INITIALIZER;
 
   char metricName[TSDB_METER_NAME_LEN] = {0};
diff --git a/src/system/detail/src/mgmtShell.c b/src/system/detail/src/mgmtShell.c
index 2e094b9251c68240fe076598ac154f76feac6e31..ba45883050e2926e6a631145842ff6a63847f1d5 100644
--- a/src/system/detail/src/mgmtShell.c
+++ b/src/system/detail/src/mgmtShell.c
@@ -733,8 +733,11 @@ int mgmtProcessAlterUserMsg(char *pMsg, int msgLen, SConnObj *pConn) {
 
   if ((pAlter->flag & TSDB_ALTER_USER_PRIVILEGES) != 0) {
     bool hasRight = false;
+
     if (strcmp(pUser->user, "root") == 0) {
       hasRight = false;
+    } else if (strcmp(pUser->user, pUser->acct) == 0) {
+      hasRight = false;
     } else if (strcmp(pOperUser->user, "root") == 0) {
       hasRight = true;
     } else if (strcmp(pUser->user, pOperUser->user) == 0) {
@@ -749,21 +752,24 @@ int mgmtProcessAlterUserMsg(char *pMsg, int msgLen, SConnObj *pConn) {
       }
     }
 
+    if (pAlter->privilege == 1) { // super
+      hasRight = false;
+    }
+
     if (hasRight) {
-      if ((pAlter->flag & TSDB_ALTER_USER_PRIVILEGES) != 0) {
-        if (pAlter->privilege == 1) {  // super
-          pUser->superAuth = 1;
-          pUser->writeAuth = 1;
-        }
-        if (pAlter->privilege == 2) {  // read
-          pUser->superAuth = 0;
-          pUser->writeAuth = 0;
-        }
-        if (pAlter->privilege == 3) {  // write
-          pUser->superAuth = 0;
-          pUser->writeAuth = 1;
-        }
+      //if (pAlter->privilege == 1) {  // super
+      //  pUser->superAuth = 1;
+      //  pUser->writeAuth = 1;
+      //}
+      if (pAlter->privilege == 2) {  // read
+        pUser->superAuth = 0;
+        pUser->writeAuth = 0;
       }
+      if (pAlter->privilege == 3) {  // write
+        pUser->superAuth = 0;
+        pUser->writeAuth = 1;
+      }
+
       code = mgmtUpdateUser(pUser);
       mLPrint("user:%s privilege is altered by %s, code:%d", pAlter->user, pConn->pUser->user, code);
     } else {