diff --git a/src/vnsw/agent/oper/agent.sandesh b/src/vnsw/agent/oper/agent.sandesh
index b4bf56db2d4..bf1953d97b3 100644
--- a/src/vnsw/agent/oper/agent.sandesh
+++ b/src/vnsw/agent/oper/agent.sandesh
@@ -346,6 +346,10 @@ objectlog sandesh SgObjectLog {
     1: SgObjectLogInfo sg;
 }
 
+traceobject sandesh SgObjectTrace {
+    1: SgObjectLogInfo sg;
+}
+
 request sandesh SgListReq {
     1: string name;
 }
diff --git a/src/vnsw/agent/oper/sg.cc b/src/vnsw/agent/oper/sg.cc
index 5b52fb9ff88..014b94ac263 100644
--- a/src/vnsw/agent/oper/sg.cc
+++ b/src/vnsw/agent/oper/sg.cc
@@ -53,9 +53,7 @@ std::auto_ptr<DBEntry> SgTable::AllocEntry(const DBRequestKey *k) const {
 
 DBEntry *SgTable::Add(const DBRequest *req) {
     SgKey *key = static_cast<SgKey *>(req->key.get());
-    SgData *data = static_cast<SgData *>(req->data.get());
     SgEntry *sg = new SgEntry(key->sg_uuid_);
-    sg->sg_id_ = data->sg_id_;
     ChangeHandler(sg, req);
     sg->SendObjectLog(AgentLogEvent::ADD);
     return sg;
@@ -73,6 +71,11 @@ bool SgTable::ChangeHandler(DBEntry *entry, const DBRequest *req) {
     SgEntry *sg = static_cast<SgEntry *>(entry);
     SgData *data = static_cast<SgData *>(req->data.get());
     
+    if (sg->sg_id_ != data->sg_id_) {
+        sg->sg_id_ = data->sg_id_;
+        ret = true;
+    }
+
     AclKey key(data->egress_acl_id_);
     AclDBEntry *acl = static_cast<AclDBEntry *>(Agent::GetInstance()->acl_table()->FindActiveEntry(&key));
     if (sg->egress_acl_ != acl) {
@@ -262,6 +265,7 @@ void SgEntry::SendObjectLog(AgentLogEvent::type event) const {
     }
     info.set_ref_count(GetRefCount());
     SG_OBJECT_LOG_LOG("AgentSg", SandeshLevel::SYS_INFO, info);
+    SG_OBJECT_TRACE_TRACE(OperDBTraceBuf, info);
 }
 
 void SgListReq::HandleRequest() const {
diff --git a/src/vnsw/agent/test/test_vmport_cfg.cc b/src/vnsw/agent/test/test_vmport_cfg.cc
index c063a00408e..b527b19f697 100644
--- a/src/vnsw/agent/test/test_vmport_cfg.cc
+++ b/src/vnsw/agent/test/test_vmport_cfg.cc
@@ -1523,8 +1523,6 @@ TEST_F(CfgTest, SecurityGroup_ignore_invalid_sgid_1) {
     EXPECT_TRUE(sg_entry != NULL);
     EXPECT_TRUE(sg_entry->GetSgId() == 2);
 
-    // Try modifying with another sg id for same uuid and it should not happen
-    // in oper. Old sgid i.e. 2 shud be retained.
     AddSg("sg1", 1, 3);
     client->WaitForIdle();
     key = new SgKey(MakeUuid(1));
@@ -1532,7 +1530,7 @@ TEST_F(CfgTest, SecurityGroup_ignore_invalid_sgid_1) {
                                             FindActiveEntry(key));
 
     EXPECT_TRUE(sg_entry != NULL);
-    EXPECT_TRUE(sg_entry->GetSgId() == 2);
+    EXPECT_TRUE(sg_entry->GetSgId() == 3);
 
     DelLink("virtual-network", "vn1", "access-control-list", "acl1");
     DelLink("virtual-machine-interface", "vnet1", "access-control-list", "acl1");