[SOLVED] Component-Based Servicing (cbs.log) causes all drive space to be consumed

Question

Because I've seen this question asked in many places and not answered, I thought I'd post my issue and resolution here.  I regard this as a Bug, but I'm not invested enough to deal with the support incident process.

I've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.

I've found that this is caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named "cbs.log".  When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.

However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp).  After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

This can be reproduced by trying to manually create the cab file -

 Directory of C:\CBS-BAK

08/26/2015  02:28 PM    <DIR>          .

08/26/2015  02:28 PM    <DIR>          ..

08/22/2015  09:12 PM     2,491,665,966 CbsPersist_20150823021618.log

C:\CBS-BAK>makecab CbsPersist_20150823021618.log

Cabinet Maker - Lossless Data Compression Tool

 86.19% - CbsPersist_20150823021618.log (1 of 1)

ERROR: (FCIAddFile)Data-size or file-count exceeded CAB format limits

C:\CBS-BAK>dir %TEMP%\cab*

 Volume in drive C is OSDisk

 Volume Serial Number is 44DE-0CDD

 Directory of C:\Users\USERNAME\AppData\Local\Temp

08/26/2015  02:31 PM       102,786,654 cab_4556_2

08/26/2015  02:28 PM                 0 cab_4556_3

08/26/2015  02:28 PM                 0 cab_4556_4

08/26/2015  02:28 PM                 0 cab_4556_5

08/26/2015  02:28 PM                 0 cab_4556_6

08/26/2015  02:28 PM        12,978,919 cab_5860_2

08/26/2015  02:27 PM                 0 cab_5860_3

08/26/2015  02:27 PM                 0 cab_5860_4

08/26/2015  02:27 PM                 0 cab_5860_5

08/26/2015  02:27 PM                 0 cab_5860_6

To resolve this -

Stop the Windows Modules Installer (TrustedInstaller) service

Delete or move the large Cbspersist_XX.log file out of \Windows\Logs\CBS.

Start the Windows Modules Installer (TrustedInstaller) service

Answer 1

Ive stopped Tiworker service and Windows. Modules installer but isn't a solution

Answer 2

See my earlier reply on using the sysinternals tool "handle" to determine which process has the cbs log locked.  The process name & service name may vary by OS.

Answer 3

I believe you're right about that. I didn't start having this issue until 1709 was installed. Now it shows it installed, but also in the update list as if it still needs to be installed. I'm ready to punt and reinstall windows and see if I can get it to work this time. I have a brand new HP notebook and if I can't get this to work I'll be sending it back with the 30 day return policy. I have all my financials and taxes to take care of for end of year and this is frustrating that I can't get it to work!

Answer 4

I'm having this problem in Windows 10 also, deleting the file is not a problem, but the fact that it keeps happening is causing me concern.

Answer 5

I finally found the answer to get the Win 10 1709 update completed and the CBS.log to return to normal use here:

https://answers.microsoft.com/en-us/windows/forum/windows\_10-update/dec-2017-update-fail-windows-10-stuck-for-hours/a7220564-562e-4a83-98fe-2b1bdf4f08f2