{"id":7511,"date":"2018-10-26T01:48:29","date_gmt":"2018-10-25T23:48:29","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=7511"},"modified":"2024-10-01T15:20:24","modified_gmt":"2024-10-01T13:20:24","slug":"windows-7-cbs-log-bug-can-fill-your-system-drive","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2018\/10\/26\/windows-7-cbs-log-bug-can-fill-your-system-drive\/","title":{"rendered":"Windows 7: CBS.log bug can fill your system drive"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" title=\"win7\" style=\"border-left-width: 0px; border-right-width: 0px; border-bottom-width: 0px; float: left; margin: 0px 10px 0px 0px; display: inline; border-top-width: 0px\" border=\"0\" alt=\"win7\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2012\/03\/win7_thumb1.jpg\" width=\"44\" align=\"left\" height=\"42\">[<a href=\"https:\/\/www.borncity.com\/blog\/2018\/10\/26\/windows-7-cbs-log-bug-mllt-festplatte-voll\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]In Windows 7 (and other versions) there is a CBS.log bug that Microsoft should have known about for years. A Windows component writes data to a log file, which can become very large as a result. However, a function to compress the log file fails if this file becomes too large. Then the system drive will be filled with trash data.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/ssl-vg03.met.vgwort.de\/na\/cce73d1c920e43188e4524311f42cc0d\" width=\"1\" height=\"1\">Woody Leonhard has discussed the problem (after a reader's tip) on <a href=\"https:\/\/web.archive.org\/web\/20190108145549\/https:\/\/www.computerworld.com\/article\/3112358\/microsoft-windows\/windows-7-log-file-compression-bug-can-fill-up-your-hard-drive.html\" target=\"_blank\" rel=\"noopener noreferrer\">ComputerWorld<\/a>. The bug occurs under Windows 7, Windows 8, Windows Server 2008 R2 and possibly under other versions. I have been alerted to this via Twitter (thx for that).<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"de\">\n<p lang=\"en\" dir=\"ltr\">ANOTHER OLD <a href=\"https:\/\/twitter.com\/Microsoft?ref_src=twsrc%5Etfw\">@MICROSOFT<\/a> BUG, CONSUMING SYSTEM DISK SPACE:<\/p>\n<p>Solutions: <a href=\"https:\/\/twitter.com\/mniehaus?ref_src=twsrc%5Etfw\">@mniehaus<\/a><\/p>\n<p>TXS: <a href=\"https:\/\/twitter.com\/SBSDiva?ref_src=twsrc%5Etfw\">@SBSDiva<\/a><a href=\"https:\/\/twitter.com\/woodyleonhard?ref_src=twsrc%5Etfw\">@woodyleonhard<\/a> <a href=\"https:\/\/twitter.com\/AdminKirsty?ref_src=twsrc%5Etfw\">@AdminKirsty<\/a> <a href=\"https:\/\/twitter.com\/thurrott?ref_src=twsrc%5Etfw\">@thurrott<\/a> <a href=\"https:\/\/twitter.com\/maryjofoley?ref_src=twsrc%5Etfw\">@maryjofoley<\/a> <a href=\"https:\/\/twitter.com\/bdsams?ref_src=twsrc%5Etfw\">@bdsams<\/a> <a href=\"https:\/\/twitter.com\/mehedih_?ref_src=twsrc%5Etfw\">@mehedih_<\/a> <a href=\"https:\/\/twitter.com\/ruthm?ref_src=twsrc%5Etfw\">@ruthm<\/a> <a href=\"https:\/\/twitter.com\/etguenni?ref_src=twsrc%5Etfw\">@etguenni<\/a> <a href=\"https:\/\/twitter.com\/SwiftOnSecurity?ref_src=twsrc%5Etfw\">@SwiftOnSecurity<\/a> <a href=\"https:\/\/twitter.com\/pcper?ref_src=twsrc%5Etfw\">@pcper<\/a> <a href=\"https:\/\/twitter.com\/MalwareJake?ref_src=twsrc%5Etfw\">@MalwareJake<\/a> <a href=\"https:\/\/twitter.com\/GossiTheDog?ref_src=twsrc%5Etfw\">@GossiTheDog<\/a> <a href=\"https:\/\/twitter.com\/ryanshrout?ref_src=twsrc%5Etfw\">@ryanshrout<\/a> <a href=\"https:\/\/twitter.com\/JobCacka?ref_src=twsrc%5Etfw\">@JobCacka<\/a><a href=\"https:\/\/t.co\/UfqsrlzAHf\">https:\/\/t.co\/UfqsrlzAHf<\/a><\/p>\n<p>\u2014 Crysta T. Lacey (@PhantomofMobile) <a href=\"https:\/\/twitter.com\/PhantomofMobile\/status\/1055301329730469888?ref_src=twsrc%5Etfw\">25. Oktober 2018<\/a><\/p><\/blockquote>\n<p><span id=\"preservea301e1edd203445683fadd8ba6554bf9\" class=\"wlWriterPreserve\"><SCRIPT charset=\"utf-8\" src=\"https:\/\/platform.twitter.com\/widgets.js\" async><\/SCRIPT><\/span> <\/p>\n<h2>The Log File Size Problem<\/h2>\n<p>The problem: For some users Windows 7 runs out of free space on the system drive at some point because hundreds of files are written in C:\\Windows\\TEMP. The cause is a bug that Microsoft must have been aware of since 2015. A user describes the issue in Microsoft Answers in <a href=\"https:\/\/answers.microsoft.com\/en-us\/windows\/forum\/windows_7-update\/solved-component-based-servicing-cbslog-causes-all\/0b91bea0-31b5-42a1-8293-e9040c4eedfa?auth=1\" target=\"_blank\" rel=\"noopener noreferrer\">this forum thread<\/a>.&nbsp; <\/p>\n<blockquote>\n<p>Component-Based Servicing (cbs.log) causes all drive space to be consumed<\/p>\n<p>Because I've seen this question asked in many places and not answered, I thought I'd post my issue and resolution here.&nbsp; I regard this as a Bug, but I'm not invested enough to deal with the support incident process.  <\/p>\n<p>I've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\\Windows\\TEMP is being consumed with hundreds of files with names following the pattern \"cab_XXXX_X\", generally 100 MB each, and these files are constantly generated until the system runs out of space.&nbsp; Upon removing the files &amp; rebooting, the files start being generated again.  <\/p>\n<p>I've found that this is caused by large Component-Based Servicing logs.&nbsp; These are stored at C:\\Windows\\Logs\\CBS.&nbsp; The current log file is named \"cbs.log\".&nbsp; When \"cbs.log\" reaches a certain size, a cleanup process renames the log to \"CbsPersist_YYYYMMDDHHMMSS.log\" and then attempts to compress it into a .cab file.  <\/p>\n<p>However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility.&nbsp; The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \\Windows\\Temp).&nbsp; After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).&nbsp; The process fails every time, and also consumes a new ~ 100 MB in \\Windows\\Temp before dying.&nbsp; This is repeated until the system runs out of drive space.<\/p>\n<\/blockquote>\n<p>In short: The Windows drive is filled with entries in the <em>Temp<\/em> folder because log files become too large.  <\/p>\n<ul>\n<li>The Component-Based Servicing function logs events under <em>C:\\Windows\\Logs\\CBS<\/em> in<em> cbs.log<\/em>.\n<li>If this file reaches a certain size, the file is renamed CbsPersist_YYYMMDDHHMMSS.log.\n<li>If the file <em>CBS.log<\/em> reaches <em>C:\\Windows\\Logs\\CBS<\/em> 2 GByte, Windows tries to compress this file with makecab.exe as CAB file. <\/li>\n<\/ul>\n<p>The problem: <em>makecab.exe<\/em> cannot compress a file larger than 2 GByte. When trying, the tool creates a 100 MByte file under <em>\\Windows\\Temp<\/em> and fails after about 20 minutes with the compression. This is then repeated until the system drive is full.&nbsp; <\/p>\n<h2>Fix: Delete the CBS.log<\/h2>\n<h2><\/h2>\n<p>If you run into this problem, you can only try to delete the <em>CBS.log<\/em> manually. The following steps are required to do this:<\/p>\n<ol>\n<li>Stop the Windows Modules Installer (TrustedInstaller) service.&nbsp;\n<li>Delete the large <em>Cbspersist_XX.log<\/em> file in <em>\\Windows\\Logs\\CBS <\/em>or move it out of the directory.\n<li>Restart the Windows Modules Installer (TrustedInstaller) service. <\/li>\n<\/ol>\n<p>If the hard disk is already full, you can boot with Windows PE and delete the files in \\Windows\\Temp. Woody Leonhard describes the steps here in more detail. After a restart the writing of the 100 MByte files in <em>\\Windows\\Temp<\/em> by <em>makecab.exe<\/em> should be omitted. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]In Windows 7 (and other versions) there is a CBS.log bug that Microsoft should have known about for years. A Windows component writes data to a log file, which can become very large as a result. However, a function to &hellip; <a href=\"https:\/\/borncity.com\/win\/2018\/10\/26\/windows-7-cbs-log-bug-can-fill-your-system-drive\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463,2],"tags":[47,194],"class_list":["post-7511","post","type-post","status-publish","format-standard","hentry","category-issue","category-windows","tag-issue","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=7511"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7511\/revisions"}],"predecessor-version":[{"id":35169,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7511\/revisions\/35169"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=7511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=7511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=7511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}