Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/a

Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recommandation_-_journalisation.pdf https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.