diff --git a/proxy/shadowsocks/protocol.go b/proxy/shadowsocks/protocol.go
index 1763e9ec..3f10e6dc 100644
--- a/proxy/shadowsocks/protocol.go
+++ b/proxy/shadowsocks/protocol.go
@@ -41,7 +41,7 @@ func ReadTCPSession(user *protocol.User, reader io.Reader) (*protocol.RequestHea
 
 	stream, err := account.Cipher.NewDecodingStream(account.Key, iv)
 	if err != nil {
-		return nil, nil, newError("failed to initialize decoding stream").Base(err)
+		return nil, nil, newError("failed to initialize decoding stream").Base(err).AtError()
 	}
 	reader = crypto.NewCryptionReader(stream, reader)
 
@@ -150,7 +150,7 @@ func WriteTCPRequest(request *protocol.RequestHeader, writer io.Writer) (buf.Wri
 
 	stream, err := account.Cipher.NewEncodingStream(account.Key, iv)
 	if err != nil {
-		return nil, newError("failed to create encoding stream").Base(err)
+		return nil, newError("failed to create encoding stream").Base(err).AtError()
 	}
 
 	writer = crypto.NewCryptionWriter(stream, writer)
@@ -262,7 +262,7 @@ func EncodeUDPPacket(request *protocol.RequestHeader, payload []byte) (*buf.Buff
 		buffer.AppendBytes(AddrTypeDomain, byte(len(request.Address.Domain())))
 		buffer.Append([]byte(request.Address.Domain()))
 	default:
-		return nil, newError("unsupported address type: ", request.Address.Family())
+		return nil, newError("unsupported address type: ", request.Address.Family()).AtError()
 	}
 
 	buffer.AppendSupplier(serial.WriteUint16(uint16(request.Port)))
@@ -314,11 +314,11 @@ func DecodeUDPPacket(user *protocol.User, payload *buf.Buffer) (*protocol.Reques
 	}
 
 	if request.Option.Has(RequestOptionOneTimeAuth) && account.OneTimeAuth == Account_Disabled {
-		return nil, nil, newError("rejecting packet with OTA enabled, while server disables OTA")
+		return nil, nil, newError("rejecting packet with OTA enabled, while server disables OTA").AtWarning()
 	}
 
 	if !request.Option.Has(RequestOptionOneTimeAuth) && account.OneTimeAuth == Account_Enabled {
-		return nil, nil, newError("rejecting packet with OTA disabled, while server enables OTA")
+		return nil, nil, newError("rejecting packet with OTA disabled, while server enables OTA").AtWarning()
 	}
 
 	if request.Option.Has(RequestOptionOneTimeAuth) {
@@ -348,7 +348,7 @@ func DecodeUDPPacket(user *protocol.User, payload *buf.Buffer) (*protocol.Reques
 		request.Address = v2net.DomainAddress(string(payload.BytesRange(1, 1+domainLength)))
 		payload.SliceFrom(1 + domainLength)
 	default:
-		return nil, nil, newError("unknown address type: ", addrType)
+		return nil, nil, newError("unknown address type: ", addrType).AtError()
 	}
 
 	request.Port = v2net.PortFromBytes(payload.BytesTo(2))