[SOLVED] Component-Based Servicing (cbs.log) causes all drive space to be consumed

Because I've seen this question asked in many places and not answered, I thought I'd post my issue and resolution here.  I regard this as a Bug, but I'm not invested enough to deal with the support incident process.

I've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.

I've found that this is caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named "cbs.log".  When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.

However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp).  After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

This can be reproduced by trying to manually create the cab file -

 Directory of C:\CBS-BAK

08/26/2015  02:28 PM    <DIR>          .
08/26/2015  02:28 PM    <DIR>          ..
08/22/2015  09:12 PM     2,491,665,966 CbsPersist_20150823021618.log

C:\CBS-BAK>makecab CbsPersist_20150823021618.log
Cabinet Maker - Lossless Data Compression Tool

 86.19% - CbsPersist_20150823021618.log (1 of 1)
ERROR: (FCIAddFile)Data-size or file-count exceeded CAB format limits

C:\CBS-BAK>dir %TEMP%\cab*
 Volume in drive C is OSDisk
 Volume Serial Number is 44DE-0CDD

 Directory of C:\Users\USERNAME\AppData\Local\Temp

08/26/2015  02:31 PM       102,786,654 cab_4556_2
08/26/2015  02:28 PM                 0 cab_4556_3
08/26/2015  02:28 PM                 0 cab_4556_4
08/26/2015  02:28 PM                 0 cab_4556_5
08/26/2015  02:28 PM                 0 cab_4556_6
08/26/2015  02:28 PM        12,978,919 cab_5860_2
08/26/2015  02:27 PM                 0 cab_5860_3
08/26/2015  02:27 PM                 0 cab_5860_4
08/26/2015  02:27 PM                 0 cab_5860_5
08/26/2015  02:27 PM                 0 cab_5860_6

To resolve this -

Stop the Windows Modules Installer (TrustedInstaller) service

Delete or move the large Cbspersist_XX.log file out of \Windows\Logs\CBS.

Start the Windows Modules Installer (TrustedInstaller) service

 

Discussion Info


Last updated March 20, 2019 Views 142,234 Applies to:

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Cheers, I will check that out in more depth tomorrow.

Seems a lot of occurrences just recently.  Do you folk think that this is related to the Win10 1709 update?  It's a large update, an OS reinstall really, so it wouldn't suprise me for it to create a larger-than-usual cbs.log.

Your system may be having trouble with the upgrade, in which case the cbs.log may be a symptom rather than the cause.

To troubleshoot the installer issue, you would need to review ... The CBS.log file.

I know I'm having the same issue and my 1709 update has not successfully installed through auto updates and even when I download the update file from Microsoft and installed it manually. This is a new computer and the first time I decided to do a clean install to start fresh however its still hanging on that update and CBS file is out of control :( .

Check out the link in my earlier reply today. Follow the instructions and see if it works for you. I have a brand new notebook, too, and was ready to return it after about 4-5 days of frustration trying to get the updates to install. Those instructions worked great for me and the cbs.log was reduced back to a reasonable size, too.

Mine won't make it a month. Cleared out yesterday, and today already using up and additional 34 gb of allocated space. At this rate, I'm out of space again before Monday.

~

It is most likely the failed 1709 update issue. Check out my earlier post on December 19th with the link to the instructions to get the update to complete. The cbs.log will then be reset and start working correctly again.
If you open up Services.mcs, it's listed under Windows Modules Installer(unless you've already done that). Right click it, click properties, then set 'Startup type' to Manual or Disabled. Disabled should end it immediately, whereas, with manual it should stay running and other services like updates and installing apps *seems* to start it up without the user doing so. I set it to disabled because it takes up 50% of my CPU usage. I have the same issue with the log files taking up space but it only happens when I shutdown or startup Windows, which leaves Windows on the 'Getting Windows Ready' screen for an hour or so and leaves me 100 - 200 GB worth of logs. I don't know if you would want to leave it disabled, though, in case some process like updates might need it.

I took delivery of a new Windows 10 computer to run our CT scanner with a 1TB SSD less that a week ago.  Today, we got an alert that we were out of disk space (0 bytes free).  I was stunned by this, as there was only a handful of executables on the computer.

I cleared off some disk space, then watched the free space drop by gigabytes at a time while doing literally nothing.

I thought it might be a virus, so I did  a scan...nothing.

Then I did a search for large files:

There are five cbspersist.log files, the smallest was 50GB, and the largest was 335GB.

I am astonished at the level of destruction, and how long this problem has been known, and that there is no warning, and that could bring a critical piece of equipment to a standstill.

https://www.computerworld.com/article/3112358/microsoft-windows/windows-7-log-file-compression-bug-can-fill-up-your-hard-drive.html

It just consumed hard disk space to the point of failure with absolutely no warning.

Check your C:\Windows\Logs\CBS for CBSPerist.log(s).

It is most likely the failed 1709 update issue. The huge cbs.log and cbspersist.log is just a symptom of the failed Windows update. You can remove the logs, but they will return once you try to update again. I found the answer to get the Win 10 1709 update completed and the CBS.log to return to normal use here:

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/dec-2017-update-fail-windows-10-stuck-for-hours/a7220564-562e-4a83-98fe-2b1bdf4f08f2

I just wanted to put my info out there. Noticed all my disk space was gone and used Treesizefree to locate the CBS.log devouring my space.... my precious... limited SSD space...... 

Experienced the same issue as many here. CBS log file well over 200 gigs, shut downs taking hours or more - all after this last updated. I did want to mention I have a Samsung Evo 850 and 840. I noticed another reply mentioned this but not sure if its related in any way. 

For now I have stopped the Windows Module Installer service from running. I have had to clear the CBS.log file three times in the last week as it keeps growing and eating all the precious space I had left. 

Answer

Thanks to this other post I was able to get my system straight. Hopefully you can find the same.

CautiousPanda replied on 

I posted this somewhere else but it sorta got drowned out by the way this forum works.

TLDR; Settings > Update > Advanced Options > Pause Updates > on > Hard reset > Install update manually from catalogue > Unpause after updater reset.

This is what worked for me when '2017-12 Cumulative Update for Windows 10 Version 1709 for x64-based Systems (KB4054517)' was not installing, even manually:

  1. Start.
  2. Settings.
  3. Update & Security.
  4. Windows Update > Scroll under the 'Update Settings' click > 'Advanced Options'.
  5. Advanced Options > Scroll under 'Pause Updates' click the slide button to 'on' to pause the update. If its not there scroll down this post to see an alternative to this step.
  6. Make sure nothing is writing to your storage and then force shutdown your computer by holding the hardware/physical power button down, then turn your computer back on. NOTE: Step 5 is what fixed manually updating for me. Other methods that official Microsoft posters have suggested may work properly from this step on but the following is what I did.
  7. When it starts back up, install the update manually from the Microsoft update catalogue. https://www.catalog.update.microsoft.com. Search: KB4054517 or the one you want. Then click the download button on the right for your version and run the link that pops up after.
  8. It should do its slow, updating restart but actually work now because of step 5.
  9. Turn the pause updates off so things work normally and remember this process if the same issue occurs in the future. Hopefully it does work normally in the future though.
  10. If it doesn't work maybe try below instead of step 5

If Pause Updates isn't there

Do this instead of step 5

  1. Open the Run command (Win + R), in it type: services.msc and press enter
  2. From the Services list find the Windows Update service
  3. Right click > properties > startup type > disabled > apply
  4. Hard Restart, go back to step 6
  5. When you get to step 9 set this service back to Automatic.

Extra:
I had hangs at 99%, I used the troubleshooter, I used the update assistant, I had the updater download the same failing update file repeatedly in the background without deleting the one that wasn't working until nearly all 110GB of my SSD was filled up, I had a bunch of error codes (don't remember which ones though), I reset/refreshed/reinstalled the Windows 10 install 3 times with no solution in sight. I was at this for 3 days.

The clue for my issue:
The Microsoft update catalogue download of the update failed saying "the following update was NOT installed" (pointing to itself) and the update troubleshooter said that there was a 'pending restart' so it could not help. Which is what lead me to pause the updates because that would turn off the pending restart. If that was making the update troubleshooter not work, maybe that was also making the manual update not work. I think that turned out to be the issue, for my case.

Someone on this thread did some more digging into why this happens I don't understand it but here: https://answers.microsoft.com/en-us/windows/forum/windows_10-update/windows-10-cumulative-update-kb4054517-fails-to/5bde0909-3d46-4725-8681-d5d500780963

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.