> Why are you storing IP addresses in your logs?
Both Apache and Nginx (and others?) log IP addresses by default. The expected result of this is that storing IP addresses in server logs is widespread, useful for troubleshooting, and entirely normal.
Both Apache and Nginx (and others?) log IP addresses by default. The expected result of this is that storing IP addresses in server logs is widespread, useful for troubleshooting, and entirely normal.
If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.
The real question is what value does storing the IP address even hold?
- You can figure out where in the world your traffic is coming from
- It can be helpful in responding to security incidents
- this can be done and then discard the address
- how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?
Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com
With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern.
Geoinformation can also change daily. Figuring it out afterwards isn't reliable.