From a0067cf5795353f714b8382fdbc0fe176a0e27cd Mon Sep 17 00:00:00 2001
From: Jules LEIDELINGER <11395311+julio75012@users.noreply.github.com>
Date: Fri, 6 Mar 2026 11:29:34 +0800
Subject: [PATCH] server: add --security-log-folder parameter for audit logging

Adds optional security audit logging capability to the llama.cpp HTTP server.
When enabled via the --security-log-folder parameter, the server will create
dated log files (security_YYYY-MM-DD.log) for security monitoring.
---
 common/arg.cpp  | 18 +++++++++++++++++-
 common/common.h |  3 ++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/common/arg.cpp b/common/arg.cpp
index 0260d79fef..a2b3c3b31f 100644
--- a/common/arg.cpp
+++ b/common/arg.cpp
@@ -2985,6 +2985,22 @@ common_params_context common_params_parser_init(common_params & params, llama_ex
             }
         }
     ).set_examples({LLAMA_EXAMPLE_SERVER}));
+    add_opt(
+        common_arg(
+            { "--security-log-folder" }, "PATH",
+            "directory for security audit logs; creates dated log files security_YYYY-MM-DD.log (default: disabled)",
+            [](common_params & params, const std::string & value) {
+                params.security_log_folder = value;
+                if (!fs_is_directory(params.security_log_folder)) {
+                    throw std::invalid_argument("not a directory: " + value);
+                }
+                // if doesn't end with DIRECTORY_SEPARATOR, add it
+                if (!params.security_log_folder.empty() &&
+                    params.security_log_folder[params.security_log_folder.size() - 1] != DIRECTORY_SEPARATOR) {
+                    params.security_log_folder += DIRECTORY_SEPARATOR;
+                }
+            })
+            .set_examples({ LLAMA_EXAMPLE_SERVER }));
     add_opt(common_arg(
         {"--models-dir"}, "PATH",
         "directory containing models for the router server (default: disabled)",
@@ -3813,4 +3829,4 @@ void common_params_add_preset_options(std::vector<common_arg> & args) {
     //     "in server router mode, do not unload this model if models_max is exceeded",
     //     [](common_params &) { /* unused */ }
     // ).set_preset_only());
-}
+}
\ No newline at end of file
diff --git a/common/common.h b/common/common.h
index ae32d5053c..ffd9f930e6 100644
--- a/common/common.h
+++ b/common/common.h
@@ -561,7 +561,8 @@ struct common_params {
     bool log_json = false;
 
     std::string slot_save_path;
-    std::string media_path; // path to directory for loading media files
+    std::string media_path;           // path to directory for loading media files
+    std::string security_log_folder;  // path to directory for security audit logs
 
     float slot_prompt_similarity = 0.1f;