Solved How to accesss to CBS log

[Louisaz]

I've run sfc/scannow several times. It indicates that there are some corrupt files that it could not fix.

I then attempted to access my CBS folder in Windows and received "ACCESS DENIED". How can I access my CBS folder to see the corrupt files that sfc/scannow could not repair?

My PC seems to be running without any glitches. I'm just curious. If the corrupted files can be fixed, I'd like to do that.

My OS is Windows 7 (Prof 64-bit).

UPDATE: I ran SFCFix and received the following report (which looks promising):

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-07-10 08:36:05.327
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.

AutoAnalysis::
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_1080_5sec_10mbps_h264.mp4 has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_1080_5sec_10mbps_h264.mp4.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_1080_5sec_MPEG2_HD_15mbps.mpg has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_1080_5sec_MPEG2_HD_15mbps.mpg.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_1080_5sec_VC1_15mbps.wmv has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_1080_5sec_VC1_15mbps.wmv.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_480i_5sec_6mbps_new.mpg has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_480i_5sec_6mbps_new.mpg.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_480p_5sec_6mbps_new.mpg has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_480p_5sec_6mbps_new.mpg.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_480_5sec_6mbps_h264.mp4 has been successfully repaired from C:\Windows\Performance\WinSAT\Clip_480_5sec_6mbps_h264.mp4.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\winsat.wmv has been successfully repaired from C:\Windows\Performance\WinSAT\winsat.wmv.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\winsatencode.wmv has been successfully repaired from C:\Windows\Performance\WinSAT\winsatencode.wmv.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18869_none_fde7d5f71db043ad\utc.app.json has been successfully repaired from C:\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8\utc.app.json.
FIXED: Corruption at C:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18869_none_fde7d5f71db043ad\telemetry.ASM-WindowsDefault.json has been successfully repaired from C:\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8\telemetry.ASM-WindowsDefault.json.
Failed to copy file E:\Windows\System32\SampleRes.dll to C:\windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\SampleRes.dll with error code ERROR_PATH_NOT_FOUND.

UPDATE #2: I've figured out how to access the SFC text file. As it turns out, Windows could not "repair" many of the Windows "sample" graphic pics I deleted long ago. That's fine with me.

Thanks for your help.

Louis (Arizona)

 

[Brink]

Hello Louis,

From your SFC log, it looks like SFC was able to repair everything except this below. These are just the sample photos for your Photos folders, so it's nothing to worry about.



Failed to copy file E:\Windows\System32\SampleRes.dll to C:\windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\SampleRes.dll with error code ERROR_PATH_NOT_FOUND.

 

[garyheard]

By the way, after you type CMD, you MUST right click the cmd.exe file and "Run as Administrator", else it won't fix anything.

And the contents you displayed I assume is results of the info from the scan, but I understand you are having a problem with reading the CBS.log file.

Regarding the "ACCESS DENIED" message when trying to read the CBS.log file, do this instead...
Copy the CBS.log file to the desktop.
From the command prompt (the black screen) enter.....
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

Now you can read the log file from cbs.txt on your Desktop.

If the root of your problem is the KB3022345 update then you should find these two errors in the CBS.txt file.
1) telemetry.ASM-WindowsDefault.json"; source file in store is also corrupted
2) utc.app.json"; source file in store is also corrupted

If so, the delete the KB3022345 update. Go to the Control Panel, click Windows Update. Then click Installed Updates.
Allow time for all the installed updates to appear.
Locate and uninstall the KB3022345 update that has affected and corrupted files.

This KB3022345 update caused my Internet Explorer 11 to interfere with watching Netflix movies. with error display message "Internet Explorer stopped working", numerous times. After clearing the error message several times, Netflix would then give up and could not continue.

So after you uninstall KB3022345 reboot your computer and run CMD (as an administrator) and enter sfc /scannow. And you should see it pass 100%.

Here's one of many references to the issue:
Microsoft confirms patch KB 3022345 breaks SFC /scannow | InfoWorld

 

[Brink]

I like using OPTION THREE below to easily get the SFC results from the CBS log.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

There's no need for him to uninstall KB3022345 since it has not affect his SFC.

 

[Louisaz]

Thanks to all for your informed replies. I'm confident that I don't have any serious issues. My PC seems to be running without any glitches.

Louis (AZ)

 

[Brink]

Glad we could help.

 

[garyheard]

Brink... Louisaz stated he couldn't open the CBS.log and apparently he sent the displayed the results of the sfc response messages, but not the contents of the CBS.log file. Going to the link you provided... SFC /SCANNOW Command - System File Checker states The KB3022345, KB3035583, and KB3068708 updates will cause SFC to give you a false mismatch message in SFC for files related to these updates. To be safe and not sorry, he should always get a 100% pass result from the SFC /scannow command, regardless if he has not noticed any obvious problems. There are always glitches in Microsoft windows, based on the Event logs, and it is best to NOT have verification errors at all. As long as he gets failures of the SFC /scannow scanning process, he'll never be able to feel secure about the integrity of his computer's performance.

 

[Brink]

Hello Gary,

SFC will still be able to repair any Windows system file as usual. It's just that the false mismatches will only be listed with those KB update numbers in the log. It will not affect anything else. Since they are false reports, there is nothing to worry about with anything in the log with those KB numbers.

 

[mannee]

Can it just be deleted

After following the steps to access the CBS file in this post, can the file just be deleted? What does it contain? Will it be recreated?

ps. I don't know if this has been posted but, you can try this as well: https://support.microsoft.com/en-us/kb/929833

 

[Brink]

Hello Mannee,

The CBS.log file is a protected OS system file. Windows will not let you delete it by default. I would recommend to not try deleting it to avoid corrupting it.

 

[mannee]

Can the CONTENTS be deleted?

 

[Brink]

You could, but you'll need to take ownership of it first.

http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

 

[mannee]

Cool. But, what's in it? It might not even be worth addressing.

 

[Brink]

It's just where Windows logs about SFC and installations.

When the CBS.log file gets to be around 50 MB in size, a CBS.persist.log will be generated. The CBS.log would be copied to the CBS.persist.log and a new CBS.log file should be started. These files are also compressed by default to help save space.