locked
CBS.log file HUGE RRS feed

  • Question

  • I've had low disk space reports generated on (4) 2008 R2 servers so far as a result of the CBS.log file growing to over 7GB in size (c:\windows\logs\CBS\CBS.log)

    Most of the entries in the file are similar to these:

    2012-08-15 09:17:17, Info                  CBS    Session: 30243568_2899427469 initialized by client WindowsUpdateAgent.

    2012-08-15 09:17:17, Info                  CBS    Read out cached package applicability for package: WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.4.7600.226, ApplicableState: 64, CurrentState:0

    2012-08-15 09:17:32, Info                  CBS    Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]

    2012-08-15 09:17:32, Info                  CBS    Session: 30243568_3047164206 initialized by client WindowsUpdateAgent.

    For some reason this file is not being compressed and regenerated like it has in the past.

    Two of the servers this has affected are excluded from receiving windows updates through WSUS and two servers do get updates via wsus.

    Has anyone seen this behavior? 

    Friday, August 24, 2012 7:43 PM

Answers

All replies

  • Maybe this one helps.

    http://social.technet.microsoft.com/Forums/en-CA/winservermanager/thread/997105d3-834c-48c0-929d-20389a0ed0f3

     

     

     


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Saturday, August 25, 2012 3:28 AM
  • SFC.exe has not been run on the system.  I see in this article that the file is suppoed to be compressed, but that is not happening.  I was able to delete CBS.log after stopping the Windows Modules Installer (actually, stopping and restarting the service seems to generated a new CBS.log file)

    Saturday, August 25, 2012 11:55 AM
  • Hello,

    Hmm, that is pretty large, the log file should stop at around 50 meg size( last servicing operation has to complete first), a new log is started, the old log is compressed and saved.

    Open an elevated cmd prompt and run the set command, report back output, want to check if something was set.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Sunday, August 26, 2012 1:54 AM
  • One other item of note, affected servers so far have all been VMs. (vSphere 5.0)

    C:\Users\dhutch>set
    ALLUSERSPROFILE=C:\ProgramData
    APPDATA=C:\Users\dhutch\AppData\Roaming
    CLIENTNAME=7210
    CommonProgramFiles=C:\Program Files\Common Files
    CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
    CommonProgramW6432=C:\Program Files\Common Files
    COMPUTERNAME=PRINT1
    ComSpec=C:\Windows\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Users\dhutch
    LOCALAPPDATA=C:\Users\dhutch\AppData\Local
    LOGONSERVER=\\DC2
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32
    \WindowsPowerShell\v1.0\
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE=AMD64
    PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 37 Stepping 1, GenuineIntel
    PROCESSOR_LEVEL=6
    PROCESSOR_REVISION=2501
    ProgramData=C:\ProgramData
    ProgramFiles=C:\Program Files
    ProgramFiles(x86)=C:\Program Files (x86)
    ProgramW6432=C:\Program Files
    PROMPT=$P$G
    PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
    PUBLIC=C:\Users\Public
    SESSIONNAME=RDP-Tcp#0
    SystemDrive=C:
    SystemRoot=C:\Windows
    TEMP=C:\Users\dhutch\AppData\Local\Temp\2
    TMP=C:\Users\dhutch\AppData\Local\Temp\2
    USERDNSDOMAIN=DOMAIN1.NET
    USERDOMAIN=DOMAIN1
    USERNAME=dhutch
    USERPROFILE=C:\Users\dhutch
    windir=C:\Windows

    Monday, August 27, 2012 12:25 PM
  • Hello,

    Hmm, that is pretty large, the log file should stop at around 50 meg size( last servicing operation has to complete first), a new log is started, the old log is compressed and saved.


    Is there any way to force this to happen?  I'm having this issue and it seems that all the research is pointed at viewing, opening, and reading the log file.  I just want to stop it from growing without needing to log into the server every couple of days.  

    Is there a setting, property, registry entry I can change to get this to happen?
    Tuesday, April 22, 2014 8:10 PM
  • There isn't a setting that I know of that will allow this to happen, no. I'll ask around and see what I can find out for you.

    --Joseph [MSFT] http://blogs.technet.com/b/joscon/

    Wednesday, April 23, 2014 2:41 PM
  • Thank you very much
    Wednesday, April 23, 2014 2:43 PM
  • Ok, just confirmed that there isn't a loglevel setting which will allow you to turn 'down' the verbosity of the log.  There is also not a setting to disable logging altogether.

    As for the logs not properly creating the cabinet files they should be, try the following:

    1. Disable the trusted installer service (Windows Modules Installer)

    2. Delete/move all of the current CBS log files from the \Windows\CBS\Logs directory

    3. Restart the Windows Modules Installer service

    4. Wait for log size to be large enough to compress properly into cabinet files

    If you have the ability to test this, I would appreciate it.  It's not something I've ever seen reported but I think this might allow the log compression process to 'reset' and start working properly.  Let me know.


    --Joseph [MSFT] http://blogs.technet.com/b/joscon/

    Wednesday, April 23, 2014 7:58 PM
  • Ok, I have cleared out the CBS directory after stopping the service and started back up.  I will keep my eye on them to see how this does.  

    I have had to do this before and didn't seem to make a difference but who know may be doing it again will help.  I will keep you updated once it reaches over 50MB which I believe is the default rotate size.

    Edit: I have also done this in two different locations with the same issue and will update accordingly.

    • Edited by rPetrie001 Wednesday, April 23, 2014 8:09 PM Addittion
    Wednesday, April 23, 2014 8:08 PM
  • Thanks, I appreciate you doing this.  Are you seeing this on one server or multiple?  What media source were this/these servers built from?

    --Joseph [MSFT] http://blogs.technet.com/b/joscon/

    Wednesday, April 23, 2014 8:12 PM
  • This is happening to many vms in our environment.  The DCs seem to be having the issue more than the rest but its just slower on those.  

    These were all created from an .ova deployment that was then created into a template in each of our prod loactions.
    Wednesday, April 23, 2014 8:16 PM
  • Just as an FYI, I just ran into this on my Windows Server 2012 VM. My CBS file was over 30GB (yes, GB); I was just a tad shocked...

    Thanks for the above procedure btw, it worked like a charm!

    Wednesday, April 30, 2014 7:16 PM
  • First, glad to see that the procedure is working.

    Second, it's interesting to me that you're hitting this at all but it makes me wonder about the images being used since you're now seeing it on more than one OS edition.  Do you happen to have an clean installed VMs that were built just from an ISO?  I'm wondering if they have the same behavior.


    --Joseph [MSFT] http://blogs.technet.com/b/joscon/

    Wednesday, April 30, 2014 7:21 PM
  • It was weird for me since i had clean the cbs file out multiple times but yet it was still happening.  Now since I have cleaned the ENTIRE directory it seems to be working correctly... this seem like very odd behaviour.  Thanks again Joseph
    Wednesday, April 30, 2014 7:25 PM
  • I found this blog which seems to point out the problem.

    I was having this problem on windows 7.

    I had a about 50g between the two directories.  I've cleaned out the c:\windows\logs\cbs completely and I'm waiting to see if I get any new cab files in c:\windows\temp.

      

    Monday, June 9, 2014 5:13 PM
  • Note that the service that must be stopped to delete the CBS.log is the Windows Module Installer.

    Thursday, September 4, 2014 6:17 PM
  • I'm using Windows 7 64 bit. My CBS.log file is 126MB. From services, the options to stop and/or disable the service are dimmed out. Any ideas how I can stop the service so I delete the log file and get the space back?
    Sunday, December 14, 2014 7:04 PM
  • This thread is answered and from more than two years ago. Please start a new thread.

     

     

     


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Sunday, December 14, 2014 9:17 PM
  • that's great!already delete it.

    thanks

    Friday, May 8, 2015 8:56 AM
  • Thank you. I had an almost 2Gb file in there (\Windows\CBS\Logs\) uncompressed. The previous 3 compressed CABs although were normal I believe (about 2-3 Mb each). Does this bug has anything to do with the Windows Update? Happened after formatting,installing and update of my Windows7 x64 (about 70-80 updates in a row). Found out after running Defraggler in the end, and seeing that CBS.log file had 3500 fragments and it was 2Gb. The thread helped me, thanks! :)
    Saturday, November 7, 2015 11:25 PM
  • Nope, this isnt an issue with Windows Update.  Just a condition the servicing stack can hit from time to time.  Glad this worked for you.

    --Joseph [MSFT] 


    Sunday, November 8, 2015 1:27 AM
  • It is problems like this that really give me a distaste for Microsoft.
    • Edited by dsulli99 Thursday, December 10, 2015 7:53 PM
    Thursday, December 10, 2015 7:52 PM
  • It is problems like this that really give me a distaste for Microsoft.

    I'd start a new thread with the details of your issues.

     

     

     


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    • Proposed as answer by Kyle Brewer Wednesday, August 23, 2017 6:53 PM
    Thursday, December 10, 2015 8:34 PM
  • I posted a PowerShell script to clean up the logs here:
    https://social.technet.microsoft.com/wiki/contents/articles/38259.clean-up-component-based-servicing-logs.aspx
    Friday, July 7, 2017 6:02 PM