Given I do not collect any personal data with an online service, at least IPs will be logged by the web server. An IP can be mapped to a person.
What I've read recently, with nginx for example you could say you remove the last octet of IPs.
I'm not aware of any EU/EEA jurisdictions that require IP addresses to be logged by website operators as a matter of course - in other words a blanket requirement. There might be circumstances when the authorities oblige a website operator to make and hand over such logs. If there were such an obligation you would have the "legal obligation" lawful basis for processing that data.
Not all IP addresses are personal data. It depends on the IP address and the circumstances. Can the data controller or another person, "with reasonable means reasonably likely to be used," use that data alone or in combination with other data to identify a natural person?
If yes, it is personal data within the meaning of the GDPR.
If no, it is not personal data within the meaning of the GDPR.
Removing or zero-ing the last octet of the IP address* is a standard way to anonymise IP addresses. See e.g. https://support.google.com/analytics/answer/2763052?hl=en for the Google Analytics approach.
*strictly: last octet of IPv4 or last 80 bits of IPv6
Do I have to log IP addresses for possible criminal investigations? Do I have to be compliant in terms of GDPR for the subject of IP logging (as IP considerable to be an "online identifier", a GDPR term)?
Generally speaking, no, although you did not specify the type of online service at issue.
To the extent that "[n]atural persons may be associated with online identifiers [...] such as internet protocol addresses" (see recital 30 of the GDPR), recital 64 discourages "retain[ing] personal data for the sole purpose of being able to react to potential requests".
Your mention that you are not collecting any personal data suggests that the protections enacted in GDPR are not at stake. If anything, logging the IPs contributes to leaving traces and tends to trigger the undesired effects as outlined in recital 30: the possibility "to create profiles of the natural persons and identify them".
Additionally, it is not necessarily true that an IP can be mapped to a person (or this depends on the type of online service). Many transactions of data packets in Internet occur without human intervention. Even if an IP can be mapped to a person, it could be in the user's professional/official/non-personal capacity rather than the personal one. The GDPR only seeks to protect the latter.
