Depends how your logging works. If you ingest logs to a remote server it's quite hard for an attacker to clean those up. Also I'd guess that most of the PHP exploits tried today weren't sophisticated but rather brute force and then either cryptomining or botnetting or something like this.