none
SBS 2011 Essentials - c:\windows\temp filled up with .cab files every half hour RRS feed

  • Discussão Geral

  • We have deployed SBS 2011 Essentials to a handfull of customers and we are seeing an annoying bug on 80% of the servers.. Every half hour there is a cab file named "cab_1209X_2, cab_8820, cab_7468" etc.  On a few of those servers the cab files are generated every hour, and the other ones every half hour. Seems to be about f.ex 00: 25 and 00:55
    sexta-feira, 22 de junho de 2012 08:08

Todas as Respostas

  • Hi Frank:

    Since no one else has reported this, afaik, then what is different about your deployments that is common to 80%?  Might it be the media used to install or the bench station that was attched to them at birth or some AV product or other third party product that is installed on them?  Some remote monitoring product perhaps?

    With process monitor, or even task manager you should be able to monitor the events on a "normal" one and compare it to one of the 80%.


    Larry Struckmeyer[SBS-MVP]

    domingo, 24 de junho de 2012 11:12
  • Do you have the latest updates installed?

    Robert Pearman SBS MVP (2011) | www.titlerequired.com | www.itauthority.co.uk

    domingo, 24 de junho de 2012 20:29
    Moderador
  • We are experimenting the same issue on a Windows Server 2008,
    Large cab_XXXX_X files in C:\Windows\Temp that consume all the disk,
    any idea on how to solve this? 
    segunda-feira, 2 de julho de 2012 15:44
  • Hmm, the servers are clean and they all have separate antivirusproduct. I hav even uninstalled the antivirus on some of the servers, but the same problem occurs. All windows updates to date are installed. No remote software except RDP. With process explorer i see there is a makecab.exe which generates these files but i have no idea of the purpose or what is triggering makecab.exe to make these files. 

    We always use the media that follows the computer, oem-media, so it can't be a "bad" media on so many servers. Hopefully...

    I have just seen these issues on sbs 2011 essentials, no other Microosft products. 

    sexta-feira, 6 de julho de 2012 07:30
  • Good job on finding it.  Internet search turns up several possibilities.  I would probably not be suggesting a new course of action if I suggest renameing that file to makecab.xxx and watch to see if anything breaks.


    Larry Struckmeyer[SBS-MVP]

    sexta-feira, 6 de julho de 2012 11:42
  • Actually i have not deared to renameing the makecab.exe because I don't know if any Microsoft products are using this fail as a critical component.

    Do you think i can rename this file without breaking the whole server?

    Edit: Sorry, I was logged in with my partner account, I am still the Frank_Iversen user 
    sexta-feira, 6 de julho de 2012 13:14
  • Should be fine.  You can always name it back.  May want to do it outside of business hours since you have put up with it for this long.

    Larry Struckmeyer[SBS-MVP]

    sexta-feira, 6 de julho de 2012 15:34
  • Seems like the file is owned by the Trustedinstaller. You think it's allright that I let the adminuser take ownership of the file and rename it?
    sábado, 25 de agosto de 2012 14:44
  • We are also having this exact same issue on SBS 2011 Essentials server. 

    This is filling up the disks. At the exact same time, we are also getting the CBS logs folder growing exponentially (C:\Windows\Logs\CBS).

    This has just completely filled up one of our clients C drives (23Gb of cab files in the temp folder and 12Gb of CBS logs).

    There doesn't appear to be any other topics about this issue that I can find - has anyone got any suggestions or a permanent fix (not a bandaid of renaming the makecab.exe file?).

    There are now 3 separate people in this topic with the same issue, so there must be a bug somewhere. 

    We are running ESET AV on these servers, but it doesn't appear to be AV related at all.

    terça-feira, 11 de setembro de 2012 01:47
  • I have a similar problem but it's on my windows 7sp1x64 workstation and the 46Mb cab is created every hour... I've just begun investigating, but my spidersense points towards windows update...

    I've just fixed the same problem on my collegues pc and it's related to windows update here.

    The "fix" was to stop windows update service, delete C:\Windows\SoftwareDistribution\DataStore\* and start the service.

    The thing we all have in common is that we have SQL studio installed and I *think* it's some sort of failed update for SQL that causes this. Isn't SQL server part of SBS 2011 too?

    • Editado TheHonch quarta-feira, 7 de novembro de 2012 13:03 solved
    quinta-feira, 20 de setembro de 2012 15:26
  • Hello,

    Having the same problem with cab* files about 63MB in size on Windows 2011 Home server SP1 fully patched and running ESET AV as well.

    Just deleted the lot and renamed Temp folder.

    Will monitor.

    Regards,

    ArkieV


    ArkieV

    quarta-feira, 26 de setembro de 2012 05:32
  • Any update on this, I am also having the same problem. Im assuming that it is ok to delete these cab_xxxx_x files since they are in the Temp folder but I would love to stop these files from being created.
    quarta-feira, 10 de outubro de 2012 16:10
  • I have deleted them without any apparent issues.

    Use this script to delete them

    del cab* c:\Windows\Temp


    ArkieV

    quarta-feira, 10 de outubro de 2012 19:02
  • Install Update Rollup for Windows SBS 2011 Essentials (KB2705117). Once installed the Cab files stopped being created.
    segunda-feira, 15 de outubro de 2012 13:09
  • I am having the same Problem on a Windows Server 2008 R2 - our System Center DPM Machine .... automatic Updates are disabled and MSE is installed as Antivirus 

    the annoying thing about it is, that the server only has 5 GB of free space and those CAB files can easy fill that space up within hours... wherever they come from :(
    quinta-feira, 8 de novembro de 2012 16:06
  • I am having the same Problem on a Windows Server 2008 R2 - our System Center DPM Machine .... automatic Updates are disabled and MSE is installed as Antivirus 

    the annoying thing about it is, that the server only has 5 GB of free space and those CAB files can easy fill that space up within hours... wherever they come from :(

    I too am having this issue with 2008 R2 Data center. I have search every where for an answer. I believe this has something to do with a failed Windows update. This has been going on for several months, has anyone come up with an answer or any way to pin point what is causing it?
    quinta-feira, 15 de novembro de 2012 19:23
  • This update has been installed September on these machines and the issue is still happening.

    cab_XXXXX files being created all the time completely filling up the C drive. We need to go in and clean the Temp folder regularly (or with a script).

    This is most obviously a bug so can someone please investigate further and fix?

    quinta-feira, 22 de novembro de 2012 00:47
  • This update has been installed September on these machines and the issue is still happening.

    cab_XXXXX files being created all the time completely filling up the C drive. We need to go in and clean the Temp folder regularly (or with a script).

    This is most obviously a bug so can someone please investigate further and fix?


    Has there been any update on this issue?
    segunda-feira, 26 de novembro de 2012 15:45
  • Found out "makecab.exe" was keeping archiving those cab files from "C:\Windows\Logs\CBS". In that folder, several big size files were found. They were created long time ago. It was believed those files were created by SFC.exe. I deleted them and also those cab files. Problem was solved.

    segunda-feira, 3 de dezembro de 2012 14:21
  • Im having the same issue on several of my Home Server 2011 servers. Ive had to create a scheduled task to delete them all, but they keep coming back.

    Is there any news on how to stop it?


    • Editado Brian'S quarta-feira, 5 de dezembro de 2012 16:39
    quarta-feira, 5 de dezembro de 2012 16:24
  • Did you also delete the files in "C:\Windows\Logs\CBS"?
    segunda-feira, 10 de dezembro de 2012 21:29
  • Deleting items in the temp folder will fix the issue short term but how can we prevent this from happening again? I need a permanent fix.
    quinta-feira, 13 de dezembro de 2012 15:42
  • I don't know exactly how it works but I had a very large file in C:\windows\logs\cbs it was a cbsPersist.log file it was almost 5GB. I deleted it and the cab files in C:\windows\temp stopped being created. I think widows creates cbs.log and cbsPersist.log files when updates are installed. After the cbsPersist.log file get so big I think windows converts them to cab files. I believe the cbsPersist.log was corrupt and could not be converted. 

    I ran the performance monitor to see what was creating the cab files and it gave me the path of C:\windows\logs\cbs\cbsPersist_xxxxxxxxxx.

    I hope this helps.

    quarta-feira, 19 de dezembro de 2012 19:22
  • Given that no one knows the root cause, there's no permanent fix.  Is anyone right now still having this issue?  I'll set up a support case if you are. 
    segunda-feira, 24 de dezembro de 2012 23:19
    Moderador
  • Hello Susan,

    That would be good, I now have a SBS 2011 Essentials server that is starting to display the same behaviour.

    Merry Christmas and a happy New Year


    ArkieV

    quarta-feira, 26 de dezembro de 2012 20:37
  • Email me at susan-at-msmvps.com please
    quarta-feira, 26 de dezembro de 2012 20:58
    Moderador
  • You guys using MozyPro by any chance?
    quarta-feira, 26 de dezembro de 2012 21:35
    Moderador
  • I don't on any of the servers.

    ArkieV


    ArkieV

    quarta-feira, 26 de dezembro de 2012 22:40
  • Maybe I have missed something but has anyone managed to come up with a fix for this yet? Susan?
    segunda-feira, 11 de fevereiro de 2013 16:38
  • Here is the solution from Kevin Royalty:

    Here is the solution (forgot to paste it yesterday)

    Issue:-

    =====

    Log files growing in size under temp folder

    Suggested Plan:-

    ============

    •   From C:\Windows\Logs\CBS remove the overgrown CBS_persist.log file (You can cut them from this location and paste it to other drive with free space) – note: I removed ALL files from here – had to stop a service to get the cbs.log file to move/delete
    •   Delete the files from the C:\Windows\Temp location (whatever you can gracefully remove)
    •   Monitor the temp folder.

    terça-feira, 12 de fevereiro de 2013 00:39
    Moderador
  • Thanks Susan, I applied this fix yesterday and so far so good. I will monitor for a couple of days and update to confirm this fixed the issue for me.

    Many Thanks

    quarta-feira, 13 de fevereiro de 2013 11:53
  • Hi Susan,

    Thanks for posting the solution, seems to have done the job for me.

    Scott

    terça-feira, 26 de março de 2013 12:52
  • Had similar issue on a server running MS ForeFront.  FF would update virus definitions a few times per day.  It called makecab.exe each time.  Over a few months the hard drive would fill up.
    segunda-feira, 15 de abril de 2013 18:05
  • same issue with the cab_* files in windows\temp

    today our central erp system crashed! Any patch from microsoft to fix this issue?

    Thanks for help!

    segunda-feira, 17 de fevereiro de 2014 15:37
  • What operating system? 

    If Essentials someone reported that "Install Update Rollup for Windows SBS 2011 Essentials (KB2705117). Once installed the Cab files stopped being created."

    But if not Essentials, there doesn't appear to be one patch that fixes this.  What's going on with your windowsupdate history?


    Unfortunately TechNet isn't coming back, sorry folks :-(

    segunda-feira, 17 de fevereiro de 2014 16:46
    Moderador
  • I have Windows Server 2008 R2 Enterprise. 2 Systems, because of a cluster. I patched both with june patchday 2014. Same problem occurs about every month ....
    terça-feira, 29 de julho de 2014 14:00
  • This totally solved it for me! I had a cbs_persist.log file from 4 months ago that was 2.8 GB! I checked all my cab_21234_2 (etc) files and sorted by date, and the date of that particular CBS_persist.log was EXACTLY when the problem started - BINGO.

    Thanks a ton, buddy!

    terça-feira, 4 de abril de 2017 03:40