Disk Clean-up and the CBS log file that it creates

Discussion in 'Windows 7' started by Palladin, Nov 2, 2015.

  1. Palladin

    Palladin MDL Senior Member

    Feb 1, 2014
    #1 Palladin, Nov 2, 2015
    Last edited: Nov 3, 2015
    I'm sure that this applies to all versions of Windows, but since I'm running Win-7 Ultimate, 64-Bit, I figured I'd post it in the Win-7 forum.

    Every time I ran Windows Disk Cleanup two files were created in the C:\Windows\Logs\CBS directory. One is DeepClean.log and the other is CBS.log. If you already have a CBS.log file the information will be appended to it. Since I've created a routine to delete the potentially gigantic CBS.log file on a daily basis, the Disk Cleanup utility just created a new CBS.log file.

    More on that if you are interested here:

    Anyway, every time I ran Disk Cleanup it created a 140Mb CBS.log file. I just deleted it and didn't think much about it. But today I decided to take a look at it for the fun of it. What I discovered surprised me. The log file has 611,000 lines in it.

    But even more surprising was the time it took to create it. The time stamp at the beginning was 09:07:07 at the time stamp of 09:08:33, it took a little over 1 minute to write 610,991 lines to the log file. Then it kinda took it's time for another 10 minutes to finish up with the last few lines.

    So what does this all mean. It means that in the time it took to read this thread, Windows could have written a half a million lines to some log file someplace. And if there was a malicious program let loose on you system, you would be hard pressed to limit the damage it could do, at least in human reaction times.

    Chances are YMMV depending on your system, speed, and configuration. But next time you decide to run Disk Cleanup, delete the CBS.log file and see what turns up and how it compares to mine.

    cbs-log-1.png cbs-log-2.png cbs-log-3b.png
  2. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    #2 abbodi1406, Nov 2, 2015
    Last edited by a moderator: Apr 20, 2017
    Unchecking "Windows Update Cleanup" in Disk Cleanup should spare you that

    CBS.log is designed to log any component servicing operation (updates)
    running DeepClean require evaluating all installed KB packages to see which are superseded

    anyway, if CBS.log really bothers you, you can disable it completely in registry:
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing]
    but, that key is protected by Trusted Installer
    so you need to manually add permissions for administrator "through registry editor" to be able to change EnableLog value
  3. Skaendo

    Skaendo MDL Addicted

    Sep 23, 2014
    #3 Skaendo, Nov 2, 2015
    Last edited: Nov 2, 2015
    I'm pretty sure that the time from 09:07:07 to 09:18:35 is 11 minutes and 28 seconds, not 11 seconds.
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. Palladin

    Palladin MDL Senior Member

    Feb 1, 2014
    #4 Palladin, Nov 2, 2015
    Last edited: Nov 3, 2015
    Of course you are correct, guess a case of temporary dumb ass on my part. Sorry. :eek:

    Now that you mention it, I took a look at the second pic, and at 09:08:33 it gets to line 610,991 in a little over one minute after it starts, and then does nothing for the next 10 minutes.

    Hopefully I can fix the pics. If not I'll just post some new ones.

    Nice catch, BTW.

    Edit: OK, got it fixed, and removed the incorrect pic and replaced it with a new one.