That's IPv6-based access to WSUS that you're seeing there.
Temporarily disable logging so that you don't fill the drive again:
- Jump into IIS Manager
- Locate the WSUS web site (it'll be the one listening on port 8530)
- Bring up the Logging properties for the root of the site
- Click "Disable" in the "Actions" pane.
That'll stop the logs from building up.
I can't say that I've seen WSUS-related traffic build up logs that big before. 4.4MB in a day isn't unheard of, but the 1.67GB in a day means that something has gone wrong.
Yesterday's log file is going to tell you lots about what was occurring. I find it hard to believe that it was all WSUS traffic. I wonder if something else didn't start banging on the server computer. Get that larger log file off of the machine and have a look at it.
Your log looks like it's in the W3C extended format. The format of that log file appears to be:
Date, Time, source IP address, HTTP request method, URI stem, probably URI query, server port, username, server IP address, user agent, HTTP result, probably Win32 status, and probably time taken
(The "probably" fields are because I can't be sure without seeing more of the file.) The header on the file will tell you the format for sure.
You need to get a look at that 1.67GB file-- it's gonna tell you what's up. Logging disabled on the site will prevent the hard drive from filling up again, but you want to know what's happening, behind the scenes, since it's going to be impacting server performance in some manner. Ultimately, you want to get to the bottom of the cause and then get logging enabled again (so that you have an audit trail if you have to track down strangeness again in the future).
Ultimately, I removed and recreated the log directory, and things started logging again, so I assume there was some kind of ACL problem, although it wasn't obvious.
Best Answer
This is possible by creating a log definition for each site. Name each log definition to correspond to the site you want the logs collected for and enabling them for the specific site you want logged to that file. Microsoft goes into some detail on this in the Advanced Logging Readme:
Source: https://www.iis.net/learn/extensions/advanced-logging-module/advanced-logging-readme
I've personally had trouble changing Advanced Logging settings at the site level in the past but you could also use a filter for each log definition to limit the scope to a single site.