Normal server logging is going to be covered under legitimate interests. Apply a reasonable retention period to it (5 year old logs are not necessary for any legitimate business purpose). Disclose it to users. Done.