Reading the GDPR rules helps you know. If you had done so, you would've known that Article 6(1)f allows you to log PPI if "processing is necessary for the purposes of the legitimate interests pursued by the controller ". Security and site reliability are legitimate interests.