In the question, you write:
The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file).
No, it does not.
To quote Miss Infogeek:
GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA.
Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing – there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied).
All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR.
One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis)
As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is extremely hard, if you are not law enforcement, to connect an IP-address to a natural person, so the data subjects rights and freedoms are minimally impacted. It is the default, and most (all?) web-sites do this.
I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).