Hector Martin

Might as well fork it.

I filed an issue. I have no reason to believe the author won't fix it, yet. Just complaining about the orig version. I'm not actually interested in the plugin myself, because I don't need stats and hashed IPs are not useful to me. I just started truncating the last octet for now.

I.e. hashed IPs are only useful if you want to do precise correlation of lots/all logs in a time window, but the only reason I keep logs (for a limited time) is for debugging and abuse, and for that I care more about knowing the ISP/country than individual IPs.

Short of encrypting log files, there's nothing I'm aware of that can do what GDPR requires. That's where this one falls short, too.

I don't think anyone (without a lawyer army) *knows* what you can/can't, must/must not do for GDPR compliance yet. For corporate stuff, it's the lawyers' problem, not mine. Personal stuff, I don't use trackers/ads and have reduced log retention, waiting for better info ¯\_(ツ)_/¯

We won't know until the first lawsuit. In my case, I'm retaining logs for 7 days for 'reasons of service abuse' and then deleting it until further notice.

I went with 14 days for now (and only 24 bits of IPv4s, 48 of IPv6s). We'll see what happens.

48 bits could be too many bits. Many providers give a /48 subnet per customer.