20

On Windows 7 (Home Premium 64 Bit), hundreds of megabytes of logging that nobody will ever care to read are written to C:\Windows\Logs\CBS\CBS.log. Take a look, we're counting the lines here:

$ dir C:\Windows\Logs\CBS\CBS.log
03.10.2015  16:21       726.097.704 CBS.log
$ findstr /b 2015- C:\Windows\Logs\CBS\CBS.log | find /c ", Info"
2990118
$ findstr /b 2015- C:\Windows\Logs\CBS\CBS.log | find /c /v ", Info"
102

In straight words, the CBS logfile (CBS is short for Component Based Services, alias Trusted Installer, see Understanding Component-Based Servicing, Apr 2008, Microsoft Technet) at the moment takes up 700 MB, 200 of which written in the last 30 minutes, with the first entry stemming from 9 days ago.

Altogether that's close to 3 million entries, and almost the entirety of it at loglevel Info. Mind you, this is a human-readable log file format, apparently not for machine processing. Don't know about you, but the notion that I should bother to take account of 3 million lines of Info by default strikes me as bordering on the absurd.

I want this to stop because the disk and CPU activity serves no purpose other than needlessly slowing the system down.

So: How do I set the log level to Warning or Error? Where is this documented?

Plus: Imagine that instead of wading through hundreds of megs of Info (for little more than a week) you'd only keep the ~100 Error lines? Wouldn't that just make sense and actually provide clues in troubleshooting? You'd then still have the option to turn on Info in case a non-obvious installation problem arises.

Update:

Reading the comments, it seems I didn't word my question with sufficient clarity. I am not asking how to filter the humungous log file using command line utilities - because I already know how to do that. I am also not asking how to deal with the log files in the way of log rotation - because Windows will do that on its own when the file reaches some unknown threshold (although you'll find people asking why the file reaches 20 gigs). What I am asking is simply how to stop this crazy hectomegabyte logging from occurring in the first place, probably by setting the log level to something higher than Info. I just can't find the documentation on how to set the log level, possibly because it doesn't exist publicly. But there must be a way because any decent software provides a way to set the log level.

Update 2:

See the answer given. The registry setting seems to take effect and shut the log up, completely. Which is okay and a much better default than the current one. In order to make the registry edit, you need to fix permissions - see appendix.

Appendix: Permissions on Component Based Servicing registry key

When you try to set EnableLog to 0, you'll probably notice that you don't have write access to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing and stuff below it. You need to go "Edit » Permissions" in regedit and then take ownership before being allowed to make edits:

Take ownership and grant yourself write permission

5
  • 3
    +5 "hectomegabyte info madness"
    – Moab
    Oct 3, 2015 at 15:44
  • 2
    CBS log can be filtered from the command prompt, here is an example of one I use after I run System File Checker, when it runs it outputs the relevant SFC info to a text file on my desktop. "findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >%userprofile%\Desktop\sfcdetails.tx"
    – Moab
    Oct 3, 2015 at 15:47
  • @Tetsujin thanks, was wondering if there were other findstr commands for other logs but google found nothing.
    – Moab
    Oct 3, 2015 at 21:34
  • 2
    Esteemed @Tetsujin, please note that the log level is only Info, not Debug, which would imply increased verbosity. See the Technet article How to enable verbose CBS logging, Nov 2010, by joscon to find out that you can make the logging even more verbose. Joscon states in a comment that »… the way its set by default is the least detailed the log gets.« That is unacceptable. It's the sort of thing that needlessly slows down your system. Not what users want. Maybe a binary edit will do.
    – Lumi
    Oct 4, 2015 at 10:21
  • On Windows Server 2008 this will eventually make TrustedInstaller.exe start crashing every 15 minutes. Or at least, I believe that this is the cause; I've been tracking this for some time now. My current attempt at a workaround is to make an empty CBS.log and remove all permissions, denying access. Have not yet confirmed if this works, since it takes some uptime before it starts happening. Jun 6, 2018 at 20:10

2 Answers 2

13

As a partial answer here's the setting to stop logging altogether: in the registry, navigate to

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing]

and set EnableLog 0. Source: https://technet.microsoft.com/en-us/library/cc732334%28v=ws.10%29.aspx#CBS

2
  • 1
    Thanks, that seems to work. After making the edit, I stopped the TrustedInstaller service, and then installed an update (KB3078667). Not a single character has been logged, yeah! In order to make the edit, you need to take ownership of the Component Based Servicing key; by default, only TrustedInstaller may write to it and its underlings. See the screenshot attached to my question.
    – Lumi
    Oct 4, 2015 at 18:43
  • TrustedInstaller can be found in Control Panel > Administrative Tools > Services under the Windows Modules Installer name (win7).
    – Ogmios
    Apr 15, 2016 at 22:23
2

CBS log is also filled by cleanmgr with roughly 150-200Mb of data even while cleaning almost 'nothing', thus filling op your disk in stead of cleaning.

I found CBS log can be cleared after stopping the TrustedInstaller service, restarting the Windows Module Installer afterwards will start the service again. Bear in mind the log is used by Microsoft in some debugging programs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .