The GDPR question depends on what the logs include. If you don't include IP (or anonymize it) and don't include sensitive data (like userids/cookies or POST dat

The GDPR question depends on what the logs include. If you don't include IP (or anonymize it) and don't include sensitive data (like userids/cookies or POST data) then it should be okay under GDPR. You can for example have one log for security (fail2ban and so on) that includes IP and one for GoAccess that does not.