135

Two days ago I had a full C: drive, after which I deleted 8 GB of data. The next day the hard drive was full again, so I continued with deleting another 5 GB, and once again the next day the disk was full.

After some searching for what caused the disk space to be filled so quickly, I used the windirstat tool to find which files took up the most space. I found out that the CBS.log file, which is located in c:\windows\logs\cbs\, is 20 GB large.

I am using Windows 8.

  • Should this file be this large, and if not, how can I reduce the size?
  • What is the purpose of this file?
  • Can I delete it?
1

6 Answers 6

34

That is a file that is generated by the Microsoft Windows Resource Checker (SFC.exe).

No, it should not be that large. The CBS.persist.log should be generated when the CBS gets to be around 50 meg in size. CBS.log should be copied to cbs.persist.log and a new cbs.log file should be started.

You can try compressing the file:

  • If you right click on the CBS.log file
  • Then click on Properties
  • On the General tab, click Advanced
  • Check "Compress contents to save disk space" and click on OK

Or, if you are sure your system is running fine, you can delete this file. SFC.exe will create a new one, next time it is run. But, it could be useful for troubleshooting issues.

4
  • 17
    Just an FYI, CBS.log isn't generated by SFC. While SFC does append to it (with the [SR] tag) it seems TrustedInstaller.exe (aka CBS aka Component Based Servicing) is the what creates the log files. Source: Understanding Component-Based Servicing
    – Vinayak
    Feb 6, 2015 at 11:09
  • 3
    Um, I seriously doubt that NTFS compression will prevent TrustedInstaller form trying to run makecab on the logfile, which will die if it's >= 2 GiB in size. A better idea is to compress it in some other explicit compression format, which would typically give it a new filename, thus preventing TrustedInstaller from pointlessly feeding it to makecab...
    – SamB
    Sep 18, 2015 at 17:16
  • 5
    @SamB is correct. This problem happens because the .CAB format has a 2GiB file size hard limitation, and TrustedInstaller will continue to issue makecab routinely, creating a new ~100MiB file in your temp folder each time. The solution is to remove the 2GB log file (which can safely be done, as these are only used for troubleshooting). Dec 25, 2015 at 21:02
  • 6
    Why is this marked as the correct answer when @Vinayak suggests its got wrong details ? Surely that's what the "edit" function is for?
    – Criggie
    Feb 11, 2016 at 1:48
89

I had a cbs.persist.log file of 17 gb, as I was sure that it wasn't me filling up my ssd, I searched for unusual big files in the windows log directory. Could only think of a compression issue anyway.

So, to reset the compression in the CBS folder I've used following method:

  1. Disable TrustedInstaller.exe (Windows Module Installer) in Taskmanager Services
  2. Delete all the .log files in the C:\Windows\Logs\ CBS directory, delete the .persist and .cab files as well
  3. Enable TrustedInstaller.exe again

NOTE: Cleaning up the CBS folder resets the compression process, so the new created log files should not get bigger than 50 Mb before the compression into .cab files as it should be.

There's no direct visual result, you need to wait until such a log file is big enough.

This solution still works for me on Windows 7 / 8 / 8.1 after 1 year

Though I can not be sure that compression will never fail again, if it does... then simply repeat the solution again but be sure to disable TrustedInstaller before deleting the files in the CBS folder.

Hope this helps.

3
  • 5
    How do you disable Windows Module Installer? In "Services" window, all the buttons to start, stop, resume, pause etc are grayed out. Windows task manager is also unable to kill TrustedInstaller.exe..
    – Slava
    Dec 28, 2015 at 10:05
  • 3
    @Alph.Dev Start services.msc via Win+R ("Run"), find the service, right click - Properties - Start: Disable. Then reboot, clean up files, and set it back to Manual or Automatic (automatic was the default on my Win7 system).
    – chrki
    Apr 30, 2016 at 16:18
  • How do you disable Windows Module Installer? 1) Press <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>Esc</kbd> to open the task manager. 2) Under Background processes, scroll down to Windows Module Installer Worker, and right-click it, then (left-)click End task. Aug 22, 2022 at 12:42
27

Just in case anyone wonders why this happens in the first place. I believe I have reproduced the special conditions (I'm sure there are other variations of these conditions that could cause the same result though):

  1. I started a very large number of very large Windows updates (a bunch of language packs and service packs etc.), while I also had a large number of other apps and windows open (I'm a developer). I then went to lunch.
  2. Windows Update ran until the system ran out of memory (RAM). I have 32 Gigabytes, but it wasn't enough.
  3. The "Trusted Installer.exe" ("Windows Module Installer" service) tried to compress the rapidly-growing log file, but couldn't run, either because the log grew too fast, or it couldn't start due to low memory, or both. So when it was needed, the Windows Module Installer service did not even start at all, (even temporarily).
  4. From then on, it could not deal with the log file, as it was too large for the .CAB compression (about 25 Gigabytes!) and so the vicious cycle had begun and nothing could stop it (except by manual intervention as described by "Gin" above).
  5. Once the log file grew to 60 Gigabytes on my SSD, it used all my free space and I got a "low storage space" warning, and started looking for the cause.

The following process seems to have fixed the issue: "disable Windows Module Installer service, delete contents of C:\Windows\Logs\CBS\ folder, and the 'C:\Windows\Temp' folder—skipping any files in use, then start Windows Module Installer service again and set it to 'manual' start (the default)". Reboot.

2
  • 2
    There were thousands of files in c:\windows\temp on my machine - hopefully, pruning that to a few hundred files will have the right effect on reducing the explosive growth of CBS.log
    – Toybuilder
    Jun 14, 2016 at 2:23
  • Just for the records, Windows updates with RAM usage through the roof (even though I would never have imagined it could be so bad that 32GB aren't enough) is this problem.
    – mirh
    Feb 15, 2020 at 15:24
10

As a workaround, on Windows 7, if the "Windows Modules Installer" service is stopped, then starting it appears to trigger the log rotation process that creates a fresh cbs.log file and moves the old file into a compressed CbsPersist .cab archive. My 500mb log file got compressed down to 30mb.

Note that it might take a few minutes to run. The service seems to stop itself automatically once it's done.

3
  • 10
    Note that doesn't work by itself if any of the files have hit the 2GiB mark already, as makecab just gives up when it gets that far in (leaving a corrupt cab_* file in %WINDIR%\Temp); in that case, you also need to dispose of the oversized CbsPersist_*.log file somehow so TrustedInstaller ("Windows Modules Installer") won't try to run makecab on them at startup. I used 7-zip to compress mine into .log.xz files, but deleting or renaming would presumably also be options. After that, restarting it will take care of the reasonably-sized ones.
    – SamB
    Sep 18, 2015 at 17:05
  • 7
    @SamB is correct. This problem happens because the .CAB format has a 2GiB file size hard limitation, and TrustedInstaller will continue to issue makecab routinely, creating a new ~100MiB file in your temp folder each time. The solution is to remove the 2GB log file (which can safely be done, as these are only used for troubleshooting). Thank you so much SamB for posting, you reached the root cause of this problem. I'm on Windows 7 SP1 64-bit. I can't believe Microsoft hasn't fixed this yet. Dec 25, 2015 at 21:03
  • If that service is active, choosing “Restart” has the same effect. The effect is not that great if you have set the Logs\CBS directory as compressed.
    – PJTraill
    Mar 16, 2016 at 19:36
5

In my case I wasn't able to stop the service even after disabling. The following steps helped me to stop the service and remove CBS log.

C:\Windows\system32>net stop TrustedInstaller
The requested pause, continue, or stop is not valid for this service.

More help is available by typing NET HELPMSG 2191.

C:\Windows\system32>sc qc TrustedInstaller
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrustedInstaller
    TYPE               : 10  WIN32_OWN_PROCESS
    START_TYPE         : 4   DISABLED
    ERROR_CONTROL      : 1   NORMAL
    BINARY_PATH_NAME   : C:\Windows\servicing\TrustedInstaller.exe
    LOAD_ORDER_GROUP   : ProfSvc_Group
    TAG                : 0
    DISPLAY_NAME       : Windows Modules Installer
    DEPENDENCIES       :
    SERVICE_START_NAME : localSystem

C:\Windows\system32>tasklist | find /i "TrustedInstaller.exe"
TrustedInstaller.exe          2164 Services                   0    132,404 K

C:\Windows\system32>taskkill /f /im "TrustedInstaller.exe"
SUCCESS: The process "TrustedInstaller.exe" with PID 2164 has been terminated.

Just in case if it would help someone.

4
1

On Server 2008 R2, My C:\windows\temp was empty. I tried deleting cbs logs and a 2.5 GB cbs log kept returning, so I checked C:\windows\temp after attempting to delete the log and a large number of .dmp files had appeared there.

Deleted these and the log file is now gone. Disk space has recovered. (Mine kept returning even after deleting it.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .