Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Logs
  4. CBS
  5. CBS.log
LogRisk: Caution

CBS.log C:\Windows\Logs\CBS\CBS.log

Main Component-Based Servicing log: update installation and detailed sfc /scannow results ([SR] entries).

Updated on By AltF4 Formation

What it’s for

CBS.log is the log of Component-Based Servicing (CBS), the stack that installs, updates and repairs Windows components. When a cumulative update fails, a feature refuses to install, or sfc /scannow reports corrupted files, this is where you find the cause. The Windows Modules Installer service writes to it, and sfc.exe tags each of its lines with [SR]. DISM.log also points here for the details of an online servicing failure.

What it contains

  • A step-by-step record of every update, feature or role installation or removal.
  • SFC’s work ([SR] lines), with messages such as “Cannot repair member file” or “Repairing corrupted file … from store”.
  • HRESULT error codes, for example 0x800f081f (source files not found).
  • A lot of volume on an old machine: several tens of megabytes are not unusual.

Risks and best practices

  • Do not read it end to end; it is far too chatty. Filter on , Error, on [SR], or on the error code Windows Update gave you.
  • Before concluding there is corruption, look at the line after “Cannot repair member file”: a flagged file is not always a real problem.
  • Keep it, it is your diagnostic trail. Copy it before you retry a repair, because the next operation appends to it.
  • If SFC cannot repair, follow with DISM /Online /Cleanup-Image /RestoreHealth, run sfc /scannow again, and read C:\Windows\Logs\DISM\dism.log alongside.

Useful commands

Fenêtre de terminal
# Last lines
Get-Content "$env:windir\Logs\CBS\CBS.log" -Tail 50


# Last errors (the level is preceded by a comma on each line)
Select-String -Path "$env:windir\Logs\CBS\CBS.log" -Pattern ", Error" | Select-Object -Last 20


# Repair components, then check system files (as administrator)
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Format

Plain text. Each line starts with a timestamp (YYYY-MM-DD hh:mm:ss), then a comma, a level (Info, Warning, Error), the emitting component (CBS, CSI) and the message.

Rotation and archiving

Older logs are archived in the same folder as CbsPersist_*.cab files. Microsoft also documents a CBS.persist.log file for component repair.

How to read it

After sfc /scannow, lines prefixed with [SR] are SFC’s work. Isolate them with findstr from an elevated command prompt:

Fenêtre de terminal
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log


:: Save them to a readable file
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfcdetails.txt"

For an update failure, start from the time of the attempt, look for Error lines around that time, and note the HRESULT code: that is what you search for next.

Report a mistake