PowerEdge: Windows CBS logs taking up too much disk space due to compression failures

• Large, uncompressed log files in the %systemroot%\Logs\CBS folder
  • There is a single CBS.log file, plus one or more files with names in the CbsPersist_datetime.log format.
• One or more large .cab files in the %systemroot%\Temp folder

Component-Based Servicing logs its activity in the %systemroot%\Logs\CBS folder. These files contain entries which are useful when troubleshooting issues with Windows Update or adding roles and features, as well they document what corrupt files, if any, are found and replaced by the System File Checker (SFC) and Dism cleanup processes.

The active log is named CBS.log. When it reaches a certain size, it is renamed to CbsPersist_datetime.log, then compressed into a .cab file of the same name. Sometimes, however, the CBS.log file's size increases rapidly, and the integrated compression utility (makecab.exe) is unable to compress it as a result.

Though this situation is rare, when it does happen, it causes disk space to be consumed rapidly. This is because makecab.exe repeatedly attempts to compress the file, fails to do so, and then tries again shortly thereafter. Each time this happens, it generates a large log file of its own (with a .cab extension) in the %systemroot%\Temp folder.

To fix the issue, perform the following steps:

1. Stop the Windows Modules Installer service using any of these methods:
   • Launch the Services console, right-click the Windows Modules Installer service, and select Stop.
   • In PowerShell, run stop-service TrustedInstaller
   • At a command prompt, run net stop TrustedInstaller.
2. Launch File Explorer and browse to %systemroot%\Logs\CBS.
3. Delete or rename all files in this folder. Do not delete the folder itself.
4. Browse to %systemroot%\Temp.
5. Delete all files in this folder that have a .cab extension.
6. Reboot the affected server.