Two days ago I had a full C: drive, after which I deleted 8 GB of data. The next day the hard drive was full again, so I continued with deleting another 5 GB, and once again the next day the disk was full.

After some searching for what caused the disk space to be filled so quickly, I used the windirstat tool to find which files took up the most space. I found out that the CBS.log file, which is located in c:\windows\logs\cbs\, is 20 GB large.

I am using Windows 8.

  • Should this file be this large, and if not, how can I reduce the size?
  • What is the purpose of this file?
  • Can I delete it?
up vote 34 down vote accepted

That is a file that is generated by the Microsoft Windows Resource Checker (SFC.exe).

No, it should not be that large. The CBS.persist.log should be generated when the CBS gets to be around 50 meg in size. CBS.log should be copied to cbs.persist.log and a new cbs.log file should be started.

You can try compressing the file:

  • If you right click on the CBS.log file
  • Then click on Properties
  • On the General tab, click Advanced
  • Check "Compress contents to save disk space" and click on OK

Or, if you are sure your system is running fine, you can delete this file. SFC.exe will create a new one, next time it is run. But, it could be useful for troubleshooting issues.

  • 15
    Just an FYI, CBS.log isn't generated by SFC. While SFC does append to it (with the [SR] tag) it seems TrustedInstaller.exe (aka CBS aka Component Based Servicing) is the what creates the log files. Source: Understanding Component-Based Servicing – Vinayak Feb 6 '15 at 11:09
  • 3
    Um, I seriously doubt that NTFS compression will prevent TrustedInstaller form trying to run makecab on the logfile, which will die if it's >= 2 GiB in size. A better idea is to compress it in some other explicit compression format, which would typically give it a new filename, thus preventing TrustedInstaller from pointlessly feeding it to makecab... – SamB Sep 18 '15 at 17:16
  • 5
    @SamB is correct. This problem happens because the .CAB format has a 2GiB file size hard limitation, and TrustedInstaller will continue to issue makecab routinely, creating a new ~100MiB file in your temp folder each time. The solution is to remove the 2GB log file (which can safely be done, as these are only used for troubleshooting). – Syclone0044 Dec 25 '15 at 21:02
  • 5
    Why is this marked as the correct answer when @Vinayak suggests its got wrong details ? Surely that's what the "edit" function is for? – Criggie Feb 11 '16 at 1:48

I had a cbs.persist.log file of 17 gb, as I was sure that it wasn't me filling up my ssd, I searched for unusual big files in the windows log directory. Could only think of a compression issue anyway.

So, to reset the compression in the CBS folder I've used following method:

  1. Disable TrustedInstaller.exe (Windows Module Installer) in Taskmanager Services
  2. Delete all the .log files in the C:\Windows\Logs\ CBS directory, delete the .persist and .cab files as well
  3. Enable TrustedInstaller.exe again

NOTE: Cleaning up the CBS folder resets the compression process, so the new created log files should not get bigger than 50 Mb before the compression into .cab files as it should be.

There's no direct visual result, you need to wait until such a log file is big enough.

This solution still works for me on Windows 7 / 8 / 8.1 after 1 year

Though I can not be sure that compression will never fail again, if it does... then simply repeat the solution again but be sure to disable TrustedInstaller before deleting the files in the CBS folder.

Hope this helps.

  • 1
    Thanks for this! "makecab.exe" was driving me crazy, keeping all 4 cores at 50% and throwing up Interactive Services Detection messages all the time. Finally Windows is behaving itself again. – bythescruff Dec 4 '15 at 11:04
  • 5
    How do you disable Windows Module Installer? In "Services" window, all the buttons to start, stop, resume, pause etc are grayed out. Windows task manager is also unable to kill TrustedInstaller.exe.. – Alph.Dev Dec 28 '15 at 10:05
  • 1
    @Alph.Dev Me too – cja Jan 14 '16 at 17:52
  • 3
    @Alph.Dev Start services.msc via Win+R ("Run"), find the service, right click - Properties - Start: Disable. Then reboot, clean up files, and set it back to Manual or Automatic (automatic was the default on my Win7 system). – chrki Apr 30 '16 at 16:18
  • There is easier way, just use LockHunter to delete it. – majkinetor Jun 13 '16 at 12:44

Just in case anyone wonders why this happens in the first place. I believe I have reproduced the special conditions (I'm sure there are other variations of these conditions that could cause the same result though):

  1. I started a very large number of very large Windows updates (a bunch of language packs and service packs etc.), while I also had a large number of other apps and windows open (I'm a developer). I then went to lunch.
  2. Windows Update ran until the system ran out of memory (RAM). I have 32 Gigabytes, but it wasn't enough.
  3. The "Trusted Installer.exe" ("Windows Module Installer" service) tried to compress the rapidly-growing log file, but couldn't run, either because the log grew too fast, or it couldn't start due to low memory, or both. So when it was needed, the Windows Module Installer service did not even start at all, (even temporarily).
  4. From then on, it could not deal with the log file, as it was too large for the .CAB compression (about 25 Gigabytes!) and so the vicious cycle had begun and nothing could stop it (except by manual intervention as described by "Gin" above).
  5. Once the log file grew to 60 Gigabytes on my SSD, it used all my free space and I got a "low storage space" warning, and started looking for the cause.

The following process seems to have fixed the issue: "disable Windows Module Installer service, delete contents of C:\Windows\Logs\CBS\ folder, and the 'C:\Windows\Temp' folder—skipping any files in use, then start Windows Module Installer service again and set it to 'manual' start (the default)". Reboot.

  • Nice post, very interesting. – zb226 Apr 6 '16 at 21:54
  • 2
    There were thousands of files in c:\windows\temp on my machine - hopefully, pruning that to a few hundred files will have the right effect on reducing the explosive growth of CBS.log – Toybuilder Jun 14 '16 at 2:23

As a workaround, on Windows 7, if the "Windows Modules Installer" service is stopped, then starting it appears to trigger the log rotation process that creates a fresh cbs.log file and moves the old file into a compressed CbsPersist .cab archive. My 500mb log file got compressed down to 30mb.

Note that it might take a few minutes to run. The service seems to stop itself automatically once it's done.

  • 10
    Note that doesn't work by itself if any of the files have hit the 2GiB mark already, as makecab just gives up when it gets that far in (leaving a corrupt cab_* file in %WINDIR%\Temp); in that case, you also need to dispose of the oversized CbsPersist_*.log file somehow so TrustedInstaller ("Windows Modules Installer") won't try to run makecab on them at startup. I used 7-zip to compress mine into .log.xz files, but deleting or renaming would presumably also be options. After that, restarting it will take care of the reasonably-sized ones. – SamB Sep 18 '15 at 17:05
  • 6
    @SamB is correct. This problem happens because the .CAB format has a 2GiB file size hard limitation, and TrustedInstaller will continue to issue makecab routinely, creating a new ~100MiB file in your temp folder each time. The solution is to remove the 2GB log file (which can safely be done, as these are only used for troubleshooting). Thank you so much SamB for posting, you reached the root cause of this problem. I'm on Windows 7 SP1 64-bit. I can't believe Microsoft hasn't fixed this yet. – Syclone0044 Dec 25 '15 at 21:03
  • If that service is active, choosing “Restart” has the same effect. The effect is not that great if you have set the Logs\CBS directory as compressed. – PJTraill Mar 16 '16 at 19:36

In my case I wasn't able to stop the service even after disabling. The following steps helped me to stop the service and remove CBS log.

C:\Windows\system32>net stop TrustedInstaller
The requested pause, continue, or stop is not valid for this service.

More help is available by typing NET HELPMSG 2191.

C:\Windows\system32>sc qc TrustedInstaller
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrustedInstaller
    TYPE               : 10  WIN32_OWN_PROCESS
    START_TYPE         : 4   DISABLED
    ERROR_CONTROL      : 1   NORMAL
    BINARY_PATH_NAME   : C:\Windows\servicing\TrustedInstaller.exe
    LOAD_ORDER_GROUP   : ProfSvc_Group
    TAG                : 0
    DISPLAY_NAME       : Windows Modules Installer
    DEPENDENCIES       :
    SERVICE_START_NAME : localSystem

C:\Windows\system32>tasklist | find /i "TrustedInstaller.exe"
TrustedInstaller.exe          2164 Services                   0    132,404 K

C:\Windows\system32>taskkill /f /im "TrustedInstaller.exe"
SUCCESS: The process "TrustedInstaller.exe" with PID 2164 has been terminated.

Just in case if it would help someone.

On Server 2008 R2, My C:\windows\temp was empty. I tried deleting cbs logs and a 2.5 GB cbs log kept returning, so I checked C:\windows\temp after attempting to delete the log and a large number of .dmp files had appeared there.

Deleted these and the log file is now gone. Disk space has recovered. (Mine kept returning even after deleting it.)

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.