Cleanup Component-Based Servicing (CBS) Logs - Too Large - system may run out of hard drive space
Log In or Register to download the BES file, and more.

6 Votes

Description

We've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.


This appears to be caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named "cbs.log".  When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.


However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp).  After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

 

This Action will remove the log files that are too large to be handled by makecab.exe.  Any \Windows\Logs\CBS\CbsPersist_XXX.log file larger than 1,000 MB is removed, as well as any cab_ files from C:\Windows\Temp.


Property Details

ID11930
StatusProduction - Fully Tested and Ready for Production
TitleCleanup Component-Based Servicing (CBS) Logs - Too Large - system may run out of hard drive space
DomainBESC
SourceInternal
Source Release Date8/26/2015 12:00:00 AM
KeywordsCBS, CBS.log, disk space, temp
Added by on 4/8/2016 11:38:20 AM
Last Modified by on 4/8/2016 11:38:20 AM
Counters 15402 Views / 282 Downloads
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 3 ratings. ** Log In or Register to add your rating.

Relevance

isWindows (Relevance 1172)
Used in 1070 fixlets and 522 analyses   * Results in a true/false
Show indented relevance
windows of operating system
Used in 21 fixlets and 3 analyses   * Results in a true/false
Show indented relevance
if exists property "in proxy agent context" then not in proxy agent context else true
Used in 2 fixlets   * Results in a true/false
Show indented relevance
version of operating system >= version "6"
Used in 2 fixlets   * Results in a true/false
Show indented relevance
exists files whose (name of it as lowercase starts with "cbspersist" and name of it as lowercase ends with ".log" and size of it / 1024 / 1024 > 1000) of folders "Logs\CBS" of windows folder

Actions

Action 1 (default)

Action Link Click here to clean up CBS logs.
Script Type BigFix Action Script
// Enter your action script here
action uses wow64 redirection false
delete __appendfile
appendfile net stop TrustedInstaller
appendfile {concatenation "%0d%0a" of ("del /q %22" & it & "%22") of pathnames of files whose (name of it as lowercase starts with "cbspersist" and name of it as lowercase ends with ".log" and size of it / 1024 / 1024 > 1000) of folders "Logs\CBS" of windows folder}
appendfile {concatenation "%0d%0a" of ("del /q %22" & it & "%22") of pathnames of files whose (name of it as lowercase starts with "cab_" ) of folders "TEMP" of windows folder}
appendfile net start TrustedInstaller

delete DeleteLog.cmd
move __appendfile DeleteLog.cmd
waithidden cmd /c DeleteLog.cmd > {pathname of windows folder}\TEMP\cbscleanup.txt 2>&1


pause while {exists files whose (name of it as lowercase starts with "cbspersist" and name of it as lowercase ends with ".log" and size of it / 1024 / 1024 > 2100) of folders "Logs\CBS" of windows folder AND (now - active start time of action) < (2 * minute)}
Success Criteria

This action will be considered successful when the applicability relevance evaluates to false.


Sharing

Social Media:
Share this page on Yammer

Comments

Log In or Register to leave comments!
bards55 -
Wow, I'm not sure how I did it, but this file seems to have fixed the problem for me to! I had to download an evaluation version of bigfix console (1.2gb!) and install that. Then import the file and run it. It deleted all of the cab files that I couldn't even delete manually due to admin rights, despite being logged in as administrator. Now refreshing the temp folder I see cab files created, raise to about 15MB and then delete by themselves. I am assuming this is normal behavior. Hopefully I don't need this fix again after the evaluation period has ended. Cheers
jgstew -
You import the BES file into the BigFix console
du30 -
Hi in which program should I run the BES File? Thank you.