Normal server logging is going to be covered under legitimate interests. Apply a reasonable retention period to it (5 year old logs are not necessary for any legitimate business purpose). Disclose it to users. Done.

This is a problem caused by people using things they don't understand. If you don't understand servers you should pay someone who does. If you know enough to debug using a log you know the log is there. But I feel this is a bit disingenuous. As far as I know no webserver logs personal information that isn't legitimate interest. Again, if you don't ask for people's information things in logs won't be a problem. It only becomes a problem when you both want to collect data and not do the work GDPR says you should. If you decide to collect personal identifiable information and refuse to secure where it ends up, you are the problem not GDPR.

Reading the GDPR rules helps you know. If you had done so, you would've known that Article 6(1)f allows you to log PPI if "processing is necessary for the purposes of the legitimate interests pursued by the controller ". Security and site reliability are legitimate interests.