Make the CBS.log useable


  1. whs
    Posts : 26,210
    Vista, Windows7, Mint Mate, Zorin, Windows 8
       New #1

    Make the CBS.log useable


    With the great help of Shawn, I was able to figure out how to reduce the massive data amounts of the CBS.log to the records of interest - those that the System file checker fixed and could not fix. With that, I have made a little tutorial about the whole process which I thought might be useful for reference:


    If you encounter a strange behavior of your system or if the system sends you a message indicating that some system file is damaged, the System File Checker might be able to help. Here is what you do:
    Open an elevated Command Prompt (go to Start > All Programs > Accessories > right click on Command Prompt > Run as Administrator).

    Type sfc /scannow into the Command Prompt window – note the blank in front of the slash (/). This will run for a while.

    When it is done, you can end up with the following different results:

    1. SFC did not find any corrupted files

    2. SFC did find corrupted files and was able to fix the files

    3. SFC was not able to fix all corrupted files

    In the cases 2 and 3, SFC stores the results in the CBS.log which you find in C:\Windows\Logs\CBS\CBS.log. This is a massive file of approximately 5MB and if you care to see it all, you must send CBS.log to one of your own folders from where you can double click on it. It will then open with Notepad. Note: You cannot open it inside the CBS folder. You will get an Access denied message.

    But most likely you are only interested in the part that shows the corrupted files that were fixed – or not fixed. For that you need a significant data reduction. You do that as follows:

    Open another elevated Command Prompt and paste this command into it:

    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

    This will show all the files you want to see in the Command Prompt window.

    Since that window is not very practical for a detailed study, you want to paste the content into a Notepad, Wordpad or Word file.


    For that you right click on the Command Prompt window (any place is good) and click Select all. Then you click on the selected text in the window. Now this whole text is stored on the clipboard and you can paste it into a document file where you can analyze it.

    A word of warning: If you have tweaked your system and modified system files, the System File Checker may undo your tweaks.
    Last edited by whs; 17 Jan 2010 at 21:24.
      My Computer
    Quote Quote

  3. seekermeister
    Posts : 6,618
    W7x64 Pro, SuSe 12.1/** W7 x64 Pro, XP MCE
       New #2

    This is good, as far as you went, but now how about an extension of the tutorial as to how to interpet the results?

    I know that using "mark" is the customary way of copying the Command Prompt, but I find it less clumsy to click select all, then just click the prompt window and it automatically gets copied.
      My Computer
    Quote Quote

  4. Tepid
    Posts : 1,403
    Win 7 Ultimate 32bit
       New #3

    I don't have a CBS.log to test this with,,

    but can you try

    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > c:\test.txt

    See if that will throw the results into the text file.
      My Computer
    Quote Quote

  6. whs
    Posts : 26,210
    Vista, Windows7, Mint Mate, Zorin, Windows 8
    Thread Starter
       New #4

    seekermeister said:
    This is good, as far as you went, but now how about an extension of the tutorial as to how to interpet the results?

    I know that using "mark" is the customary way of copying the Command Prompt, but I find it less clumsy to click select all, then just click the prompt window and it automatically gets copied.

    Good point on the "select all". I changed the post acccordingly - forgot all about it.. Thanks.
    As far as the interpretation of the results goes, that's another story. I did not want to venture into all the cases and possible permutations. But if you have a proposal for some generic text, i would be grateful.
      My Computer
    Quote Quote

  7. seekermeister
    Posts : 6,618
    W7x64 Pro, SuSe 12.1/** W7 x64 Pro, XP MCE
       New #5

    Not me. I was looking for the light that I don't have.
      My Computer
    Quote Quote

  8. Tepid
    Posts : 1,403
    Win 7 Ultimate 32bit
       New #6

    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > c:\test.txt

    This does work by the way,, so you don't have to copy paste from the command window

    This will also work,,,
    Open Notepad and paste this to it and save as whatever.cmd

    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > c:\test.txt

    test.txt

    This will run the string, and save then open the results in notepad.

    You can then change "[SR]" to whatever you want to search for in that particular file.
      My Computer
    Quote Quote

  10. robertpri
    Posts : 46
    Win 7 - 64 Pro
       New #7

    I am so glad to find this! After running SFC., it makes a log that I could not open.

    Okay, that is solved, but I am having a hard time reading the results:

    There appears to be four errors, but autochk.exe seems bad.

    Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.76 00.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    2010-10-18 19:05:55, Info CSI 000002f4 [SR]

    Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.76 00.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    2010-10-18 19:05:55, Info CSI 000002f5 [SR]

    This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
    2010-10-18 19:05:55, Info CSI 000002f8 [SR]

    Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"autochk.exe"; source file in store is also corrupted
      My Computer
    Quote Quote

  11. CarlTR6
    Posts : 11,990
    Windows 7 Ultimate 32 bit
       New #8

    Excellent thread. Thank you, Wolfgang. I can't rep you...
      My Computer
    Quote Quote

  12. cjb4
    Posts : 30
    Windows 10 Pro 64-bit Build 17134
       New #9

    Great post! Now next steps?


    Thanks great post.
    Question: At what point do you run a repair on Windows 7 Pro sp1 64bit. I have had some random shut-downs which I attributed to my Wildfire SSD and blank screens which are related to my GPU.
    Of course my original install disk is not sp1.
    Reviewing the log, many files were repaired but many we un-repairable. Most seemed to be associated with speech recognition which I don't use.
    I've uploaded the filtered CBS file (using the excellent command by tepid and whs).
    Any advice?
    Make the CBS.log useable Attached Files
      My Computer
    Quote Quote

  13. ChrisProphet
    Posts : 1
    Windows Home Premium 64bit
       New #10

    Hey I followed your guide, very good! Now that i found corrupted data how do i fix it. Im assuming the PAGE_FAULT BSOD errors im getting are related to these prossessor errors.

    Here is what i got,

    2012-03-17 11:50:29, Info CSI 000002e7 [SR] Cannot repair me
    mber file [l:24{12}]"perfdisk.dll" of Microsoft-Windows-PerformanceBaseCounters,
    Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutra
    l, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neut
    ral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002e8 [SR] Cannot repair me
    mber file [l:24{12}]"perfctrs.dll" of Microsoft-Windows-PerformanceBaseCounters,
    Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutra
    l, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neut
    ral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002e9 [SR] Cannot repair me
    mber file [l:34{17}]"PerfCenterCpl.ico" of Microsoft-Windows-PerfCenterCPL, Vers
    ion = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, Ve
    rsionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral,
    TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002ea [SR] Cannot repair me
    mber file [l:24{12}]"perfdisk.dll" of Microsoft-Windows-PerformanceBaseCounters,
    Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutra
    l, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neut
    ral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002eb [SR] This component w
    as referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364
    e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
    2012-03-17 11:50:29, Info CSI 000002ec [SR] Cannot repair me
    mber file [l:24{12}]"perfctrs.dll" of Microsoft-Windows-PerformanceBaseCounters,
    Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutra
    l, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neut
    ral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002ed [SR] This component w
    as referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364
    e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
    2012-03-17 11:50:29, Info CSI 000002ee [SR] Could not reproj
    ect corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"pe
    rfdisk.dll"; source file in store is also corrupted
    2012-03-17 11:50:29, Info CSI 000002ef [SR] Could not reproj
    ect corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"pe
    rfctrs.dll"; source file in store is also corrupted
    2012-03-17 11:50:29, Info CSI 000002f0 [SR] Cannot repair me
    mber file [l:34{17}]"PerfCenterCpl.ico" of Microsoft-Windows-PerfCenterCPL, Vers
    ion = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, Ve
    rsionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral,
    TypeName neutral, PublicKey neutral in the store, file is missing
    2012-03-17 11:50:29, Info CSI 000002f1 [SR] This component w
    as referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856
    ad364e35~amd64~~6.1.7601.17514.Microsoft-Windows-Client-Features-Update"
    2012-03-17 11:50:29, Info CSI 000002f2 [SR] Could not reproj
    ect corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:34{17}]"Pe
    rfCenterCpl.ico"; source file in store is also corrupted
    2012-03-17 11:50:29, Info CSI 000002f4 [SR] Repair complete
    2012-03-17 11:50:29, Info CSI 000002f5 [SR] Committing trans
    action
    2012-03-17 11:50:29, Info CSI 000002f9 [SR] Verify and Repai
    r Transaction completed. All files and registry keys listed in this transaction
      My Computer
    Quote Quote

 

  Related Discussions
so about a month ago i got my self a bit more ram for my pc for better load times what not and with in 3 days i find out that only a part of my ram is usable the most ram this garbage mobo can handle is 4gb yet i'm only able to use 3.37 my os is windows 7 home premium 64 bit current mobo:...
:mad: Okay so I know there are alot of threads on this but literally none of them have helped me resolve my problem. My windows 7 64 bit is showing that I have 6GB of ram (yet only 4gb useable)... I checked the 'resource monitor' and there is 2 gb reserved for something and I would like to know...
Useable RAM?
in General Discussion

Hi People! I have just built myself a brand new system! It's got a nifty i5 CPU, a brand new Gigabyte motherboard and its got 8GB DDR3 RAM and I've Installed Windows Home Premium 32 bit! It's working perfectly....BUT (there's always a "but' isn't there?) BUT when you checkout the system...
RAM - useable
in Hardware & Devices

Question my computer has recently started showing my RAM as below: http://i55.tinypic.com/25pomlw.png 1.50gb useable, when 4GB is installed :confused:
Useable Ram
in Hardware & Devices

I've noticed a few other threads on these boards dealing with the same issue. But I thought I'd just throw my scenario out there to see if anybody could help... When I first bought my Dell it came with 2 gigs of ram installed. I recently installed 2 more gigs, thinking that I would max out...
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 00:58.
Find Us