Why is CBS.log file size 20 GB

Solution 1:

That is a file that is generated by the Microsoft Windows Resource Checker (SFC.exe).

No, it should not be that large. The CBS.persist.log should be generated when the CBS gets to be around 50 meg in size. CBS.log should be copied to cbs.persist.log and a new cbs.log file should be started.

You can try compressing the file:

• If you right click on the CBS.log file
• Then click on Properties
• On the General tab, click Advanced
• Check "Compress contents to save disk space" and click on OK

Or, if you are sure your system is running fine, you can delete this file. SFC.exe will create a new one, next time it is run. But, it could be useful for troubleshooting issues.

Solution 2:

I had a cbs.persist.log file of 17 gb, as I was sure that it wasn't me filling up my ssd, I searched for unusual big files in the windows log directory. Could only think of a compression issue anyway.

So, to reset the compression in the CBS folder I've used following method:

1. Disable TrustedInstaller.exe (Windows Module Installer) in Taskmanager Services
2. Delete all the .log files in the C:\Windows\Logs\ CBS directory, delete the .persist and .cab files as well
3. Enable TrustedInstaller.exe again

NOTE: Cleaning up the CBS folder resets the compression process, so the new created log files should not get bigger than 50 Mb before the compression into .cab files as it should be.

There's no direct visual result, you need to wait until such a log file is big enough.

This solution still works for me on Windows 7 / 8 / 8.1 after 1 year

Though I can not be sure that compression will never fail again, if it does... then simply repeat the solution again but be sure to disable TrustedInstaller before deleting the files in the CBS folder.

Hope this helps.

Solution 3:

Just in case anyone wonders why this happens in the first place. I believe I have reproduced the special conditions (I'm sure there are other variations of these conditions that could cause the same result though):

1. I started a very large number of very large Windows updates (a bunch of language packs and service packs etc.), while I also had a large number of other apps and windows open (I'm a developer). I then went to lunch.
2. Windows Update ran until the system ran out of memory (RAM). I have 32 Gigabytes, but it wasn't enough.
3. The "Trusted Installer.exe" ("Windows Module Installer" service) tried to compress the rapidly-growing log file, but couldn't run, either because the log grew too fast, or it couldn't start due to low memory, or both. So when it was needed, the Windows Module Installer service did not even start at all, (even temporarily).
4. From then on, it could not deal with the log file, as it was too large for the .CAB compression (about 25 Gigabytes!) and so the vicious cycle had begun and nothing could stop it (except by manual intervention as described by "Gin" above).
5. Once the log file grew to 60 Gigabytes on my SSD, it used all my free space and I got a "low storage space" warning, and started looking for the cause.

The following process seems to have fixed the issue: "disable Windows Module Installer service, delete contents of C:\Windows\Logs\CBS\ folder, and the 'C:\Windows\Temp' folder—skipping any files in use, then start Windows Module Installer service again and set it to 'manual' start (the default)". Reboot.

Solution 4:

As a workaround, on Windows 7, if the "Windows Modules Installer" service is stopped, then starting it appears to trigger the log rotation process that creates a fresh cbs.log file and moves the old file into a compressed CbsPersist .cab archive. My 500mb log file got compressed down to 30mb.

Note that it might take a few minutes to run. The service seems to stop itself automatically once it's done.

Solution 5:

In my case I wasn't able to stop the service even after disabling. The following steps helped me to stop the service and remove CBS log.

C:\Windows\system32>net stop TrustedInstaller
The requested pause, continue, or stop is not valid for this service.

More help is available by typing NET HELPMSG 2191.

C:\Windows\system32>sc qc TrustedInstaller
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrustedInstaller
    TYPE               : 10  WIN32_OWN_PROCESS
    START_TYPE         : 4   DISABLED
    ERROR_CONTROL      : 1   NORMAL
    BINARY_PATH_NAME   : C:\Windows\servicing\TrustedInstaller.exe
    LOAD_ORDER_GROUP   : ProfSvc_Group
    TAG                : 0
    DISPLAY_NAME       : Windows Modules Installer
    DEPENDENCIES       :
    SERVICE_START_NAME : localSystem

C:\Windows\system32>tasklist | find /i "TrustedInstaller.exe"
TrustedInstaller.exe          2164 Services                   0    132,404 K

C:\Windows\system32>taskkill /f /im "TrustedInstaller.exe"
SUCCESS: The process "TrustedInstaller.exe" with PID 2164 has been terminated.

Just in case if it would help someone.