Cleanup Component-Based Servicing (CBS) Logs - Too Large - system may run out of hard drive space
| 7 Votes |
Description
We've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space. Upon removing the files & rebooting, the files start being generated again.
This appears to be caused by large Component-Based Servicing logs. These are stored at C:\Windows\Logs\CBS. The current log file is named "cbs.log". When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.
However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility. The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp). After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience). The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying. This is repeated until the system runs out of drive space.
This Action will remove the log files that are too large to be handled by makecab.exe. Any \Windows\Logs\CBS\CbsPersist_XXX.log file larger than 1,000 MB is removed, as well as any cab_ files from C:\Windows\Temp.
Property Details
| 11930 | |
| Production - Fully Tested and Ready for Production | |
| Cleanup Component-Based Servicing (CBS) Logs - Too Large - system may run out of hard drive space | |
| BESC | |
| Internal | |
| 8/26/2015 12:00:00 AM | |
| CBS, CBS.log, disk space, temp | |
| JasonWalker on 4/8/2016 11:38:20 AM | |
| JasonWalker on 4/8/2016 11:38:20 AM | |
| 20199 Views / 325 Downloads | |
 
* Average over 3 ratings.
** Log In or Register to add your rating.
|
Relevance
| Used in 2 fixlets | * Results in a true/false |
| Used in 2 fixlets | * Results in a true/false |
Actions
Action 1 (default)
// Enter your action script here
action uses wow64 redirection false
delete __appendfile
appendfile net stop TrustedInstaller
appendfile {concatenation "%0d%0a" of ("del /q %22" & it & "%22") of pathnames of files whose (name of it as lowercase starts with "cbspersist" and name of it as lowercase ends with ".log" and size of it / 1024 / 1024 > 1000) of folders "Logs\CBS" of windows folder}
appendfile {concatenation "%0d%0a" of ("del /q %22" & it & "%22") of pathnames of files whose (name of it as lowercase starts with "cab_" ) of folders "TEMP" of windows folder}
appendfile net start TrustedInstaller
delete DeleteLog.cmd
move __appendfile DeleteLog.cmd
waithidden cmd /c DeleteLog.cmd > {pathname of windows folder}\TEMP\cbscleanup.txt 2>&1
pause while {exists files whose (name of it as lowercase starts with "cbspersist" and name of it as lowercase ends with ".log" and size of it / 1024 / 1024 > 2100) of folders "Logs\CBS" of windows folder AND (now - active start time of action) < (2 * minute)}
This action will be considered successful when the applicability relevance evaluates to false.
Sharing
| Social Media: |
Comments
 |
|
| Wow, I'm not sure how I did it, but this file seems to have fixed the problem for me to! I had to download an evaluation version of bigfix console (1.2gb!) and install that. Then import the file and run it. It deleted all of the cab files that I couldn't even delete manually due to admin rights, despite being logged in as administrator. Now refreshing the temp folder I see cab files created, raise to about 15MB and then delete by themselves. I am assuming this is normal behavior. Hopefully I don't need this fix again after the evaluation period has ended. Cheers | |
 |
|
| You import the BES file into the BigFix console | |
 |
|
| Hi in which program should I run the BES File? Thank you. | |
