Windows 7 log file compression bug can fill up your hard drive

[Karlston]

Microsoft has known about this bug in the Trusted Installer log for years, but done nothing about it

Having a hard time with Windows gobbling up your hard drive? You'll be interested to learn Microsoft has known about the problem for more than two years and done nothing about it. There's a manual fix, which I will discuss, but it isn't clear if this solution works in all cases.

 

This is a known problem with Windows 7, 8, and 2008 R2 (and possibly other versions) where accumulated log files grow to an enormous size -- 237GB according to one report. If you delete the files, Windows kicks in every 20 minutes or so and starts generating 100MB files, continuously, until you run out of hard drive space -- again. The overflow files go into your Windows Temp folder, typically C:\Windows\Temp.

 

Poster jwalker107 on the Microsoft Answers forum describes the symptoms:

I've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.

 

I've found that this is caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named "cbs.log".  When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.

 

However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is too large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp). 

 

After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

The basic idea is that once the Trusted Installer CBS log in C:\Windows\Logs\CBS grows to more than 2GB, the CAB compression utility (which Microsoft prefers to the far more common Zip) can't handle it. Microsoft's makecab.exe chokes on files bigger than 2GB.

 

The result is a deadly embrace between TrustedInstaller (the Windows Modules Installer Service) and the CAB compressor (makecab.exe), which throws off enormous volumes of useless Temp files and sucks up cycles like nobody's business.

 

There are incorrect solutions to the problem all over the web, but one approach seems to end the madness. If your Windows 7 or 2008 R2 hard drive is overwhelmed by log files, here's what to do:

 

Step 1. Stop the Windows Modules Installer service. Click Start and in the Search box type services.msc

 

Press Enter and you see the Local Services list.

 

Step 2. Scroll down to the Windows Modules Installer service and double-click on it.

 

Step 3. Under Service status, click Stop. Click OK.

 

Step 4. Use File Explorer to go to C:\Windows\Logs\CBS. (If Windows is installed on a different hard drive, you have to go to that drive.)

 

Step 5. Move or rename all of the files in that folder.

 

Step 6. For good measure, delete all the "cab*" files in your Windows Temp folder, typically C:\Windows\Temp. Makecab won't ever delete them, so you get to.

 

Step 7. Reboot.

 

When Windows comes back, the Windows Module Installer service will be running again, and makecab should stop choking on the oversized log file.

 

If you need the big CBS.log file -- unlikely but possible -- just use a text reader like Notepad to go into the renamed or moved file. If you aren't terribly interested in the log files, you can delete them.

 

Thanks to AskWoody.com poster ch100 for the tip.

 

Source: Windows 7 log file compression bug can fill up your hard drive (InfoWorld - Woody Leonhard)

 

InfoWorld - Woody on Windows

 

AskWoody.com - Woody Leonhard's no-bull news, tips and help for Windows and Office

[straycat19]

I have never seen this happen and have been responsible for over 250,000 Windows 7 systems since it was released.  Therefore it would seem that this is a rarity and not something to be concerned with.  Out of curiosity I checked a few of my personal desktops and laptops and there are cab files in the CBS Logs folder but the total size of those files was never greater than 40MB and there was hardly anything in the windows/temp dir.

[Ballistic Gelatin]

Just checked my CBS Logs folder...it's a 'huge' 218 KB. Not an issue for me.

[flash48]

I have had this problem in the past.  The root cause was a file corruption and the windows update would keep on failing and the CBS log files got huge.  Also this issue was sucking up all my cpu cycles.  When I finally resolved the corruption problem all went back to normal.

[Rivenson]

@straycat19

... 250,000 Win7 systems ?? 

[Str8Sh00t3r]

edited: dont matter

[steven36]

23 hours ago, flash48 said:

I have had this problem in the past.

Go figure it even  happened too one person  out 6 now 7 comments in this topic ..And the one who bragged  about being over 250,000 pcs says the problem never existed for them and would be no help too people who  had that problem .Sounds like a  Windows 10 user because they never had the problem they think it dont exist   and  they claim they have millions of beta  testers and still they released it to the general public full of bugs  pushing out updates to fixes bugs causing more bugs . I read were a Sysadmin said they still never fixed all the bugs in Windows 7 enterprise yet  much less going fix them for windows 10 now.