Technical Anshu
Tutorials Blog
💾 CBS Log Bloat

CBS Logs Eating Gigabytes The Log Bloat Signature and the Fix

Some PCs do not fill up in one jump — they bleed. A few GB gone today, a few more tomorrow, and the trail ends at one folder: C:\Windows\Logs\CBS, stuffed with enormous log files. This is the CBS log-bloat pattern, and it has a specific, safe repair.

✍️ Technical Anshu🪟 Windows 11⏱️ 8 minute fix
🎥 Watch the full process in the video — tracing where the space went and cleaning it the right way

CBS is the Component-Based Servicing engine — the part of Windows that installs updates and optional features. It keeps a diary of its work in C:\Windows\Logs\CBS. Old diary pages are meant to be compressed and archived small. When that compression fails — classically when a log grows past the size the compressor can handle — the archives stop shrinking and start stacking up at full size, while failed compression attempts litter C:\Windows\Temp with huge temporary files. The drive fills with paperwork.

C:\Windows\Logs\CBS — the bloat signature, example folder
CbsPersist_20261018.log1.9 GB
CbsPersist_20261019.log2.0 GB
CbsPersist_20261020.log2.0 GB
CBS.log (current)48 MB LEAVE IT
The signature: several CbsPersist archives each near 2 GB, repeating daily. Healthy PCs hold the same history compressed into small cabinet files instead.
Example folder listing, simplified. One giant log is a bad week; a repeating stack of them is the bloat pattern.
1

Confirm the Signature Before Touching Anything

  1. Open C:\Windows\Logs\CBS and sort by size. The pattern to confirm: multiple CbsPersist files, each hundreds of MB to around 2 GB
  2. Glance at C:\Windows\Temp for large files named like cab_xxxx — these are the failed compression attempts, and they confirm the diagnosis
  3. A disk scanner such as WizTree, run as administrator, shows the same picture in seconds if you prefer a visual check
  4. If instead one single file deep in ProgramData is the giant, that is the CapabilityAccessManager pattern, not this one — different fix
2

Why the Logs Explode — the Compression Trap

When a servicing session ends, Windows archives its log: the archive tool compresses the log into a small cabinet file. The trap is size. Once a session log grows beyond what that compression step can process — around the 2 GB mark — the compression fails every time. The uncompressed log stays at full size, the next session writes another, and the failed attempts leave their large temporary cab files behind. Nothing in this chain deletes your data; it is purely the servicing diary failing to file itself away.

3

The Fix — Stop the Service, Clear the Dead Logs, Restart

  1. Open Command Prompt or Terminal as administrator
  2. Stop the servicing engine so no log is open: net stop TrustedInstaller — if it reports the service is not started, that is fine, continue
  3. In C:\Windows\Logs\CBS, delete the oversized CbsPersist archive files. These are closed diaries of finished sessions — deleting them removes history text, nothing else
  4. In C:\Windows\Temp, delete the large leftover cab_ temporary files from the failed compressions
  5. Leave the current CBS.log alone — after the restart the service recreates and manages it normally
  6. Restart the PC. The Windows Modules Installer service is on-demand and will start by itself when servicing next runs
4

After the Cleanup — Repair the Servicing Health

Clearing the logs reclaims the space, but a PC that bloated once deserves one health pass so the servicing stack stays sane.

  1. Install any pending Windows updates and restart — current builds carry years of servicing fixes
  2. Shrink the accumulated superseded-update copies with DISM /Online /Cleanup-Image /StartComponentCleanup from an administrator prompt
  3. Check the CBS folder again after the next Patch Tuesday. Small compressed archives are success; another stack of 2 GB logs means the servicing store itself needs a repair — that is when DISM /Online /Cleanup-Image /RestoreHealth enters the picture
5

The Line You Must Not Cross

  1. This fix touches log files only — finished text diaries and failed temporary archives
  2. It never touches the WinSxS component store. That folder only looks like ordinary files; deleting from it by hand breaks updating and app servicing in ways that often end in a reinstall
  3. It never touches the live CBS.log while servicing is running — stopping the service first is what makes the cleanup safe
  4. And it is not a space strategy. If logs are healthy and small, your missing space is elsewhere — measure the drive before assuming
🔴 Logs yes, component store never. CbsPersist archives and failed cab temp files are paper you may shred once the service is stopped. The WinSxS folder beside them is machinery — the only tools allowed to shrink it are DISM and Disk Cleanup.

🎥 Watch the Complete Video Guide

The CBS log bloat traced and cleared — part of the full after-update space recovery in the video.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Are CBS log files safe to delete?

The archived ones are. CbsPersist files are closed logs of finished update sessions — deleting them removes diagnostic history, not system components. Stop the Windows Modules Installer service first with net stop TrustedInstaller, delete the oversized archives and the failed cab temp files in Windows\Temp, then restart. Leave the WinSxS component store completely alone.

What is the difference between CBS.log and CbsPersist files?

CBS.log is the live diary of the current servicing activity — Windows is writing to it whenever updates or features are being serviced. When a session ends, that diary is archived as a CbsPersist file and compressed. In the bloat pattern, the compression fails, so CbsPersist files pile up at around 2 GB each instead of shrinking.

Why did the CBS logs grow so large in the first place?

A servicing session that generates a very large log — heavy update activity, repeated failures, or a stubborn repair loop — can push the log past what the built-in compression step can archive. From then on every archive attempt fails, full-size logs stack up daily, and failed attempts leave large cab temp files behind. Clearing the backlog and keeping Windows updated stops the cycle in most cases.

This guide is based on the Technical Anshu C drive full after update video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏