Very large system folder?

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?
--
Jeff Barnett

In article , , Jeff Barnett
says...

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That folder should not, in general, be over 50Mb's - the default
rollover size.

I've fixed this problem on several W7 PC's. There could be a few
causes, but my resolution in the past is to:
1. stop the windows trusted installer service (TrustedInstaller/Windows
Modules Installer)
2. Delete (or more safely move) the CBS files
3. restart the service and watch the folder.

It should grow, and possibly be above 50Mb's, which is normal, but
should stablize at around 50Mb's as it cab's up (compresses) the files.

If it keeps growing way out of bounds, still, then...
4. run CCleaner

If that doesn't help, look at problems with Windows Update (reset it).
Run SFC. But in my experience, when it gets to this stage (and if the
client's paying for it), it's often easier, quicker, and cheaper, to re-
install!

--
Duncan.

Jeff Barnett wrote:

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That's pretty huge. My \windows\logs folder is only 62 MB in size
(300th the size of yours - assuming you didn't get MB and GB mixed up).

The sfc.exe (system file checker) program writes a CbsPersist_num.cab
file each time it is ran. I have 5 of them with the largest at 24 MB.
Someone elsewhere noted they can be up to 50 MB in size. The cab files
are compressed so they are a lot smaller than the original log files.
Some folks enable compression on that folder to reduce its disk
footprint but that does not eliminate the cause of generating all those
huge logs. Those files are useful only when troubleshooting problems.
SFC will create a new one if the old one is missing, so the old one can
be deleted if you have no use for it.

I use CCleaner to frequently cleanup my computer. It has a "Windows Log
Files" option (enabled by default) but doesn't delineate just what logs
it will delete when ran with this option enabled. I have it clean out
my temp folders (which could result in getting rid of the CBS log file
overflow into the %temp% folder, as noted in the article at the bottom
of my post).

CBS logs = Component-Based Servicing logs

This folder is associated to the Windows Modules Installer service.
Others have noted that they have to disable this service, reboot the OS,
and then they can delete the CBS files. Others mention to just stop
this service to delete the log files; however, you will probably have to
change permssions on this folder and its files to grant your Windows
account (or the security group it is in) to allow deleting the files.
Its service description is:

Enables installation, modification, and removal of Windows updates and
optional components. If this service is disabled, install or uninstall
of Windows updates might fail for this computer.

I disable updates until about a week after Patch Tuesday. I don't need
to be checking every day for updates and I want a week's grace, or more,
to allow time for others to report on troubles or analyses on new
updates. I never allow automatic updates since those might keep
retrying on the failed ones. I review each update and decide whether to
install it or hide it. If the update fails, sometimes I investigate but
more often I just hide the update. Quite often the failed update is not
critical or even needed, especially for a driver update that fails for
an existing driver that works just fine with its hardware.

How often are you checking for updates? Are they failing and you keep
retrying them? Update failures generate extensive log records because
of the large number of errors to track.

http://www.infoworld.com/article/311...ard-drive.html

Jeff Barnett wrote:
I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

And what about the file names ?

Do the files belong in there, or not ?

There's a description of a root cause here. They use makecab
to compress the CBS log, but it cannot handle files 2GB or larger.
If the compression process bombs out, the cleaning process helps
fill the disk, and it will then try the exact same thing again.

http://www.infoworld.com/article/311...ard-drive.html

If you have your installer DVD, you can always boot to the
Command Prompt and do the cleanup from there. While it's
fun (and easy) to stop a service, some of the service recovery
procedures can result in the service starting again before you're
finished. Whereas, booting to the Command Prompt, from the installer
DVD, you should have more control of the situation.

Paul

Dave Doe wrote on 3/15/2017 2:34 PM:
In article , , Jeff Barnett
says...

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That folder should not, in general, be over 50Mb's - the default
rollover size.

I've fixed this problem on several W7 PC's. There could be a few
causes, but my resolution in the past is to:
1. stop the windows trusted installer service (TrustedInstaller/Windows
Modules Installer)
2. Delete (or more safely move) the CBS files
3. restart the service and watch the folder.

It should grow, and possibly be above 50Mb's, which is normal, but
should stablize at around 50Mb's as it cab's up (compresses) the files.

If it keeps growing way out of bounds, still, then...
4. run CCleaner

If that doesn't help, look at problems with Windows Update (reset it).
Run SFC. But in my experience, when it gets to this stage (and if the
client's paying for it), it's often easier, quicker, and cheaper, to re-
install!


I tried a slight variant: I booted into safe mode and moved the files
from CBS to a directory on another disk, all of them. I then booted into
normal Windows and noted that the Trusted Installer wasn't running so I
started it. After a few hours, the only content is the file CBS.log and
it is only 6K. It'll be interesting to see how this all plays out.
--
Jeff Barnett

Jeff Barnett wrote on 3/15/2017 8:49 PM:
Dave Doe wrote on 3/15/2017 2:34 PM:
In article , , Jeff Barnett
says...

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That folder should not, in general, be over 50Mb's - the default
rollover size.

I've fixed this problem on several W7 PC's. There could be a few
causes, but my resolution in the past is to:
1. stop the windows trusted installer service (TrustedInstaller/Windows
Modules Installer)
2. Delete (or more safely move) the CBS files
3. restart the service and watch the folder.

It should grow, and possibly be above 50Mb's, which is normal, but
should stablize at around 50Mb's as it cab's up (compresses) the files.

If it keeps growing way out of bounds, still, then...
4. run CCleaner

If that doesn't help, look at problems with Windows Update (reset it).
Run SFC. But in my experience, when it gets to this stage (and if the
client's paying for it), it's often easier, quicker, and cheaper, to re-
install!


I tried a slight variant: I booted into safe mode and moved the files
from CBS to a directory on another disk, all of them. I then booted into
normal Windows and noted that the Trusted Installer wasn't running so I
started it. After a few hours, the only content is the file CBS.log and
it is only 6K. It'll be interesting to see how this all plays out.

I installed some MS updates and rebooted. The contents of the CBS
directory is now the single file CBS.log weighing in at 177MB! That
file, before emptying the LOG directory was only 17MB. There are no CAB
files in the LOG directory. Yet.
--
Jeff Barnett

In article , , Jeff Barnett
says...

Jeff Barnett wrote on 3/15/2017 8:49 PM:
Dave Doe wrote on 3/15/2017 2:34 PM:
In article , , Jeff Barnett
says...

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That folder should not, in general, be over 50Mb's - the default
rollover size.

I've fixed this problem on several W7 PC's. There could be a few
causes, but my resolution in the past is to:
1. stop the windows trusted installer service (TrustedInstaller/Windows
Modules Installer)
2. Delete (or more safely move) the CBS files
3. restart the service and watch the folder.

It should grow, and possibly be above 50Mb's, which is normal, but
should stablize at around 50Mb's as it cab's up (compresses) the files.

If it keeps growing way out of bounds, still, then...
4. run CCleaner

If that doesn't help, look at problems with Windows Update (reset it).
Run SFC. But in my experience, when it gets to this stage (and if the
client's paying for it), it's often easier, quicker, and cheaper, to re-
install!


I tried a slight variant: I booted into safe mode and moved the files
from CBS to a directory on another disk, all of them. I then booted into
normal Windows and noted that the Trusted Installer wasn't running so I
started it. After a few hours, the only content is the file CBS.log and
it is only 6K. It'll be interesting to see how this all plays out.

I installed some MS updates and rebooted. The contents of the CBS
directory is now the single file CBS.log weighing in at 177MB! That
file, before emptying the LOG directory was only 17MB. There are no CAB
files in the LOG directory. Yet.

Sounds good and normal to me Jeff. Keep your eye on it.

--
Duncan.

On Thu, 16 Mar 2017 11:18:31 -0400, Wolf K
wrote:

On 2017-03-16 10:44, Wolf K wrote:
On 2017-03-15 15:33, Jeff Barnett wrote:
I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

CCleaner (free) will clean out the logs and other temporary/leftover
files. The default setting is to remove files older than 24 hours.

OTOH, if you have the typical 500MB or larger HDD, you're saving about
4% or less of available space.

Sorry, s/b 500GB


Typical? I thought that even 500GB sounded like it was on the low
side. I would have said 1TB.

So, just out of curiosity, I went to Dell's web side. The cheapest
computer I saw there (an Inspiron Small Desktop for $299.99) came with
a 1TB drive.

On Thu, 16 Mar 2017 14:52:33 -0400, Wolf K
wrote:

On 2017-03-16 13:27, Ken Blake wrote:
On Thu, 16 Mar 2017 11:18:31 -0400, Wolf K
wrote:

On 2017-03-16 10:44, Wolf K wrote:
On 2017-03-15 15:33, Jeff Barnett wrote:
I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

CCleaner (free) will clean out the logs and other temporary/leftover
files. The default setting is to remove files older than 24 hours.

OTOH, if you have the typical 500MB or larger HDD, you're saving about
4% or less of available space.

Sorry, s/b 500GB


Typical? I thought that even 500GB sounded like it was on the low
side. I would have said 1TB.

So, just out of curiosity, I went to Dell's web side. The cheapest
computer I saw there (an Inspiron Small Desktop for $299.99) came with
a 1TB drive.

... so I'm 6 months behind the curve...


LOL! I'm probably farther behind than that on most things.

they need to get away from the hard ways of microsoft thieves.
I do suggest, http://www.novirusthanks.org/

They also have a smart file delete. And if anything else,
you should dump their firewall quickly and start using a real firewall.
All yee have to do, is rename the file, leave it where it is, and start
a new one. If it bothers you, delete it. IF it messes up, rename it
back. Its only a log file. I do mean, most of you dont use
administration tools, and if the machine messes up, your going to go the
backup to fix it, likely the clone image.
Its like, once you learn that windows 6.1 firewall is not worth a dam
for control of your machine, then you will get the idea of what they are
doing. Much of the services are bs thats not needed. Anyway, soon
they will delete their help to 6.1, same as they already did with xp.
Then you have to go to the backup anyway, cause the most of you, are not
going to mess with the registry yourself and that log file. And having
a cleaner do it, is not so well. You must know what software you run.
To be on the safe side about cleaners. The only other thing that log
file is used for, is like event viewer, and computer management...
Those, are administration tools. The system folder has its own log
files. You can also trace where that log file is used when it runs in
the event viewer. As a matter of fact, you can tell when your computer
was born inside the event viewer, so you know how old it really is...
Instead of what the store told to you...

On 3/15/2017 1:40 PM, VanguardLH wrote:
Jeff Barnett wrote:

I discovered that the directory \windows\logs\ has over 17GB of files on
my machine. The CBS subdirectory has about 98-99% of the total. Is there
any way to radically and safely reduce the size of this stuff?

That's pretty huge. My \windows\logs folder is only 62 MB in size
(300th the size of yours - assuming you didn't get MB and GB mixed up).

The sfc.exe (system file checker) program writes a CbsPersist_num.cab
file each time it is ran. I have 5 of them with the largest at 24 MB.
Someone elsewhere noted they can be up to 50 MB in size. The cab files
are compressed so they are a lot smaller than the original log files.
Some folks enable compression on that folder to reduce its disk
footprint but that does not eliminate the cause of generating all those
huge logs. Those files are useful only when troubleshooting problems.
SFC will create a new one if the old one is missing, so the old one can
be deleted if you have no use for it.

I use CCleaner to frequently cleanup my computer. It has a "Windows Log
Files" option (enabled by default) but doesn't delineate just what logs
it will delete when ran with this option enabled. I have it clean out
my temp folders (which could result in getting rid of the CBS log file
overflow into the %temp% folder, as noted in the article at the bottom
of my post).

CBS logs = Component-Based Servicing logs

This folder is associated to the Windows Modules Installer service.
Others have noted that they have to disable this service, reboot the OS,
and then they can delete the CBS files. Others mention to just stop
this service to delete the log files; however, you will probably have to
change permssions on this folder and its files to grant your Windows
account (or the security group it is in) to allow deleting the files.
Its service description is:

Enables installation, modification, and removal of Windows updates and
optional components. If this service is disabled, install or uninstall
of Windows updates might fail for this computer.

I disable updates until about a week after Patch Tuesday. I don't need
to be checking every day for updates and I want a week's grace, or more,
to allow time for others to report on troubles or analyses on new
updates. I never allow automatic updates since those might keep
retrying on the failed ones. I review each update and decide whether to
install it or hide it. If the update fails, sometimes I investigate but
more often I just hide the update. Quite often the failed update is not
critical or even needed, especially for a driver update that fails for
an existing driver that works just fine with its hardware.

How often are you checking for updates? Are they failing and you keep
retrying them? Update failures generate extensive log records because
of the large number of errors to track.

http://www.infoworld.com/article/311...ard-drive.html

tesla sTinker wrote:

They also have a smart file delete.

As has been mentioned, 3rd party software is not required to delete the
CBS log files.

And if anything else, you should dump their firewall quickly and start
using a real firewall.

I don't need any firewall to block Windows updates (and then grant them
when I'm prepared for them - image backup, have the time, enable WU,
review each update, apply the okayed ones and hide the others, and
disable WU). I don't just configure the WU client to "notify only"
mode. I disable the BITS and WU services. I use a batch file for
convenience that enables the services, run the WU client, review each
update, and after runs a batch file for convenience to disable the
services. If the services aren't running, there is no Windows updating.

I don't need to rely upon a firewall to control Windows updating. Since
the firewall is running in user mode, kernel mode processes, like from
the OS, can circumvent software firewalls. Even if the firewall employs
kernel-mode drivers, the OS still controls the load order.