Windows 7 log file compression bug can fill up your hard drive

Microsoft has known about this bug in the Trusted Installer log for years, but done nothing about it

Windows 7 log file compression bug can fill up your hard drive
Thinkstock

Having a hard time with Windows gobbling up your hard drive? You'll be interested to learn Microsoft has known about the problem for more than two years and done nothing about it. There's a manual fix, which I will discuss, but it isn't clear if this solution works in all cases.

This is a known problem with Windows 7, 8, and 2008 R2 (and possibly other versions) where accumulated log files grow to an enormous size -- 237GB according to one report. If you delete the files, Windows kicks in every 20 minutes or so and starts generating 100MB files, continuously, until you run out of hard drive space -- again. The overflow files go into your Windows Temp folder, typically C:\Windows\Temp.

Poster jwalker107 on the Microsoft Answers forum describes the symptoms:

I've had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern "cab_XXXX_X", generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.

I've found that this is caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named "cbs.log".  When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.

However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is too large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp).  After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

The basic idea is that once the Trusted Installer CBS log in C:\Windows\Logs\CBS grows to more than 2GB, the CAB compression utility (which Microsoft prefers to the far more common Zip) can't handle it. Microsoft's makecab.exe chokes on files bigger than 2GB.

The result is a deadly embrace between TrustedInstaller (the Windows Modules Installer Service) and the CAB compressor (makecab.exe), which throws off enormous volumes of useless Temp files and sucks up cycles like nobody's business.

There are incorrect solutions to the problem all over the web, but one approach seems to end the madness. If your Windows 7 or 2008 R2 hard drive is overwhelmed by log files, here's what to do:

Step 1. Stop the Windows Modules Installer service. Click Start and in the Search box type

services.msc

Press Enter and you see the Local Services list.

Step 2. Scroll down to the Windows Modules Installer service and double-click on it.

Step 3. Under Service status, click Stop. Click OK.

Step 4. Use File Explorer to go to C:\Windows\Logs\CBS. (If Windows is installed on a different hard drive, you have to go to that drive.)

Step 5. Move or rename all of the files in that folder.

Step 6. For good measure, delete all the "cab*" files in your Windows Temp folder, typically C:\Windows\Temp. Makecab won't ever delete them, so you get to.

Step 7. Reboot.

When Windows comes back, the Windows Module Installer service will be running again, and makecab should stop choking on the oversized log file.

If you need the big CBS.log file -- unlikely but possible -- just use a text reader like Notepad to go into the renamed or moved file. If you aren't terribly interested in the log files, you can delete them.

Thanks to AskWoody.com poster ch100 for the tip.

Copyright © 2016 IDG Communications, Inc.