Just plain weird gigantic CBS.log

I'm running Win 7 Ultimate, 64 Bit, so this might not apply to other versions, but probably will.

Nothing weird is probably going on. Windows writes to that log file way too much information. Somebody at Microsoft figured it would be a good idea to log every little bit of information they could. As the log file grows to some pre-determined amount, it will be archived, and stored in the same CBS directory. The archive files can be quite large and some report 10's of Gigs of space taken up by them. I got a feeling that all of this info gets sent back to MS at some point, but I can't be 100% sure.

In some ways that's a good thing, since troubleshooting is much easier with detailed logs. But they way they organized the collection leaves much to be desired. Finding information in what gets written when is problematic at best.

Once a month I restore a clean working image and then update it with all the necessary Windows and other software updates, leaving out the ones that I don't want and adding the ones I want. When I did it this month, the CBS file started out at 0 bytes and grew to over 950MB in an hour or so. I took a look at it and there was entry after entry of stuff that meant nothing to me. I deleted the file.

I noticed this behavior long ago and decided to do something about it. Since the log files are pretty much useless to the average person, I figured I'd copy them to a daily file, store the daily file for a while and then delete the daily files after a while. I'm sure that there is valuable information in the CBS log files, but I have never used it, and honestly have no clue as to what all the entries mean. Somebody at MS probably does, but the entries are a mystery to me.

I created a directory under the C:\Windows\Logs\CBS\old and then run this batch file once a day:

Code:

ren "%windir%\logs\cbs\cbs.log" "%date:~4,2%%date:~7,2%%date:~12,2%_%time:~0,2%.%time:~3,2%.%time:~6,2%_CBS.Log"
copy %windir%\logs\cbs\*.log %windir%\logs\cbs\old
pause
del %windir%\logs\cbs\*.log /f /q
del %windir%\logs\dism\*.* /f /q
del %windir%\logs\dpx\*.* /f /q

This renames the CBS.log file to today's date and time and looks like this: "090515_ 4.40.14_CBS.Log" Where the 090515 is the current date, the 4.40.14 is the time. You can format the time and date differently if you want.


To see the different options in parsing out the system %date% and %time% variables, copy this Codes snippet below and save it as a .bat file and run it to see the different date options available. Note: The way you parse the variables will depend on the Time and Date formats for your region. If you get goofy results that don't match what's in this batch file, then check your Date and Time settings in Control Panel. Note: The offset count begins at 0, not 1.

I wanted to format the time as HH:MM:SS but ran into errors trying to use a ":" (colon) in the command line, so I ended up using a "." in the final batch file I ended up using.

Code:

@echo off
cls
echo Date format = %date%
echo dd = %date:~7,2%
echo mm = %date:~4,2%
echo yyyy = %date:~10,4%
echo.
echo Time format = %time%
echo hh = %time:~0,2%
echo mm = %time:~3,2%
echo ss = %time:~6,2%
echo.
echo Timestamp = %date:~4,2%-%date:~7,2%-%date:~10,4%_%time:~0,2%.%time:~3,2%.%time:~6,2%

An alternate option is this syntax:

Code:

for /f "tokens=1-5 delims=:" %%d in ("%time%") do rename "%windir%\logs\cbs\cbs.log" "%%d-%%e-%%f_cbs.log"
ren "%windir%\logs\cbs\cbs.log" "%date:/=-% %time::=-%_CBS.Log"

I compressed the command line to eliminate spaces in the output, and it's a little hard to parse out. Here's what it looks like with the commands separated:

Code:

This is the command with the spaces added. It parses fine without them, but it's a bit awkward to read
ren "%windir%\logs\cbs\cbs.log" "%date:~4,2% %date:~7,2% %date:~12,2%_%time:~0,2%.%time:~3,2%.%time:~6,2%_CBS.Log"
--------------------------------------------^-----------^------------^-----------^-----------^-----------^

Be aware that if you run this batch file while Windows is writing information to the CBS log file, you will get an error message. The file will be copied but not renamed to the date and time. That's why I insert a "Pause" in the batch file, so I know to rename the file to the current date and time. After a while your backup directory will look something like this:



And while your are at it, you may as well clean up the Extended Trace Log files (*.etl) that Windows creates and sends back to the mother ship:

Spoiler

echo Now clearing the etl files ....
del %programdata%\Microsoft\*.etl /s /f
del %systemdrive%\Users\*.etl /s /f
del %windir%\system32\*.etl /s /f
del %windir%\servicing\sqm\*.* /s /f /q

Good luck.

 

I think you are right, but it's hard to get your head around how Windows can write a 950MB file in under an hour. I don't remember if I checked the number of lines in that file, but based on the other files it was probably 500,000- 700,000 lines written to that file in about an hour. And I have to question WTF that was all about. To say nothing of the system resources required to do it. And for Gigabyte file, it had to extract even more resources.

On another note, when you mentioned Ccleaner, I thought to myself, "Hmm...I haven't run that program in a while." I downloaded the latest version, checked all the boxes, and let it run. When I went to do some maintenance on the CBS directory where I had stored the old files, the directory was empty. As were the all the files in the DISM and DPX sub-directories.

Seems like Ccleaner got rid on all files in those directories. NBD, but I find it odd that Ccleaner would delete all the files in a non-standard Windows sub-directory (old) that I created under the CBS directory. I'll have to remember to move them someplace before I run Ccleaner again.

Oh well, live and learn.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

I don't know

but the variable description is clear, it's for tracing and logging
so yes, i would delete it

 

I deleted the windows_tracing_logfile as well as the windows_tracing_flags and I'm happy to report that for the last few days, Windows hasn't even created one CBS.log file.

Zip, zero, nada.

Although I did run DWS_1.5.345 (Destroy Windows Spying) so that might have something to do with it. Dunno

I'm hoping that there's nothing in those logs I need to worry about. But since I've never used them I don't think I'll miss them.