Author Topic: CBS log file (Read 43762 times)

shemaya · « **on:** January 11, 2015, 09:59:08 pm »

Hi Shane, I ran sfc to check and the operation reported that there were corrupt files that could not be fixed. I copied the log file but dot not understand what it means. Can you please help.
Thanks
John

Shane · « **Reply #1 on:** January 12, 2015, 01:08:37 pm »

I am seeing a lot of errors like

Quote

2015-01-12 11:33:11, Info CBS Session: 30420479_1478311993 initialized by client WindowsUpdateAgent.
2015-01-12 11:33:11, Info CBS Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]

And

Quote

2015-01-12 16:16:24, Info CBS SQM: Initializing online with Windows opt-in: False
2015-01-12 16:16:24, Info CBS SQM: Cleaning up report files older than 10 days.
2015-01-12 16:16:24, Info CBS SQM: Requesting upload of all unsent reports.
2015-01-12 16:16:24, Info CBS SQM: Failed to start upload with file pattern: C:\windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL]
2015-01-12 16:16:24, Info CBS SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL]
2015-01-12 16:16:24, Info CBS SQM: Queued 0 file(s) for upload with pattern: C:\windows\servicing\sqm\*_all.sqm, flags: 0x6
2015-01-12 16:16:24, Info CBS SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL]

Is windows updates working on that system at all? SFC will try to download missing files it needs, if windows updates isnt working or is blocked that would explain the errors. I would also do a chkdsk for bad sectors on the drive as well just to make sure as well.

Shane

shemaya · « **Reply #2 on:** January 12, 2015, 11:29:00 pm »

Hi Shane,
1. Yes windows update is working.
2. I have run check disk- no problems.
3. I have run sfc in safe mode and still corrupt files.
4. The error message is widows protection resource has corrupt files and could not be fixed.
5. attached new cbs.log file

Boggin · « **Reply #3 on:** January 13, 2015, 04:10:16 am »

Can you post the chkdsk /r report ?

Not sure if you know how to do this but go Start - type eventvwr then press enter.

When Event Viewer has read the logs, expand Windows Logs - click on Application - Action - Find - then type chkdsk or wininit and press enter.

Close the Find box then click on Copy in the lower right pane then click on Copy details as text.

Place the cursor in the Reply box - right click and select Paste.

I'll leave it to Shane to decipher the CBS log but with a Win 7 SP1 install disk you can run an off boot sfc /scannow where it can replace any corrupt files from the disk.

If you don't have an install disk that has SP1 you can download and Save the ISO from http://www.w7forums.com/threads/official-windows-7-sp1-iso-image-downloads.12325/page-2#post-124821 and use http://www.microsoft.com/en-us/download/windows-usb-dvd-download-tool to create a bootable USB/DVD.

Change the boot order for a one off by tapping F12 as you switch on, select the media you are using, insert it then press enter.

You will be prompted to press any key to boot from that media and that will either produce a screen with the option to press F8 or it will take you straight to the splash screen.

Press F8 if you get that screen then select Safe Mode with Command Prompt and when you get the splash screen select Repair your Computer and navigate to the Recovery Environment then select Command Prompt.

At the command prompt enter bcdedit |find "osdevice" and using whichever partition letter it gives, enter (assuming C)

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

That's a Pipe symbol before find and there's a space before each forward slash.

There's one Dism command that I find which will work on Win 7 and that is dism /offline /cleanup-image /scanhealth which may give a clearer summary of what is wrong.

This is also done from an elevated command prompt.

When submitting a sfc CBS log, it can make easier reading when you use the [SR] commands as in Option Three of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

shemaya · « **Reply #4 on:** January 13, 2015, 05:03:11 am »

Log Name: Application
Source: Chkdsk
Date: 13/01/2015 6:40:25 PM
Event ID: 26212
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: John1-Laptop
Description:
Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
256512 file records processed.

File verification completed.
1010 large file records processed.

0 bad file records processed.

0 EA records processed.

58 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
325580 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
256512 file SDs/SIDs processed.

Cleaning up 193 unused index entries from index $SII of file 0x9.
Cleaning up 193 unused index entries from index $SDH of file 0x9.
Cleaning up 193 unused security descriptors.
Security descriptor verification completed.
34535 data files processed.

CHKDSK is verifying Usn Journal...
35519824 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

285212671 KB total disk space.
100998984 KB in 218254 files.
128880 KB in 34536 indexes.
0 KB in bad sectors.
370363 KB in use by the system.
65536 KB occupied by the log file.
183714444 KB available on disk.

4096 bytes in each allocation unit.
71303167 total allocation units on disk.
45928611 allocation units available on disk.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Chkdsk" />
<EventID Qualifiers="0">26212</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-01-13T07:40:25.000000000Z" />
<EventRecordID>41848</EventRecordID>
<Channel>Application</Channel>
<Computer>John1-Laptop</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
256512 file records processed.

File verification completed.
1010 large file records processed.

0 bad file records processed.

0 EA records processed.

58 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
325580 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
256512 file SDs/SIDs processed.

Cleaning up 193 unused index entries from index $SII of file 0x9.
Cleaning up 193 unused index entries from index $SDH of file 0x9.
Cleaning up 193 unused security descriptors.
Security descriptor verification completed.
34535 data files processed.

CHKDSK is verifying Usn Journal...
35519824 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

285212671 KB total disk space.
100998984 KB in 218254 files.
128880 KB in 34536 indexes.
0 KB in bad sectors.
370363 KB in use by the system.
65536 KB occupied by the log file.
183714444 KB available on disk.

4096 bytes in each allocation unit.
71303167 total allocation units on disk.
45928611 allocation units available on disk.
</Data>
<Binary>00EA030081DB0300A9F0060000000000A85100003A0000000000000000000000</Binary>
</EventData>
</Event>

Boggin · « **Reply #5 on:** January 13, 2015, 08:59:13 am »

While chkdsk in read-only mode can be handy as a quick check for bad sectors, it's better to run either a chkdsk /f or chkdsk /r to check for file corruption.

Can you run either of those to see what that reports and then run another sfc /scannow to see if that is still reports corrupt files.

Shane · « **Reply #6 on:** January 13, 2015, 09:01:44 am »

Correct. You where running chkdsk in normal mode which doesnt check for bad sectors. That scan will take a while depending on your hard drive size. Have it do that and then post the results of it

Shane

shemaya · « **Reply #7 on:** January 13, 2015, 03:29:29 pm »

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 14/01/2015 9:57:32 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: John1-Laptop
Description:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
257024 file records processed.

File verification completed.
1022 large file records processed.

0 bad file records processed.

0 EA records processed.

58 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
326450 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
257024 file SDs/SIDs processed.

Cleaning up 354 unused index entries from index $SII of file 0x9.
Cleaning up 354 unused index entries from index $SDH of file 0x9.
Cleaning up 354 unused security descriptors.
Security descriptor verification completed.
34714 data files processed.

CHKDSK is verifying Usn Journal...
35974968 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

285212671 KB total disk space.
107703216 KB in 221101 files.
130132 KB in 34715 indexes.
0 KB in bad sectors.
371351 KB in use by the system.
65536 KB occupied by the log file.
177007972 KB available on disk.

4096 bytes in each allocation unit.
71303167 total allocation units on disk.
44251993 allocation units available on disk.

Internal Info:
00 ec 03 00 53 e7 03 00 6d 04 07 00 00 00 00 00 ....S...m.......
ab 51 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 .Q..:...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-01-13T22:57:32.000000000Z" />
<EventRecordID>41959</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>John1-Laptop</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
257024 file records processed.

File verification completed.
1022 large file records processed.

0 bad file records processed.

0 EA records processed.

58 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
326450 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
257024 file SDs/SIDs processed.

Cleaning up 354 unused index entries from index $SII of file 0x9.
Cleaning up 354 unused index entries from index $SDH of file 0x9.
Cleaning up 354 unused security descriptors.
Security descriptor verification completed.
34714 data files processed.

CHKDSK is verifying Usn Journal...
35974968 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

285212671 KB total disk space.
107703216 KB in 221101 files.
130132 KB in 34715 indexes.
0 KB in bad sectors.
371351 KB in use by the system.
65536 KB occupied by the log file.
177007972 KB available on disk.

4096 bytes in each allocation unit.
71303167 total allocation units on disk.
44251993 allocation units available on disk.

Internal Info:
00 ec 03 00 53 e7 03 00 6d 04 07 00 00 00 00 00 ....S...m.......
ab 51 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 .Q..:...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

shemaya · « **Reply #8 on:** January 13, 2015, 03:39:57 pm »

cbs.log

Boggin · « **Reply #9 on:** January 14, 2015, 06:37:35 am »

Unless Shane can nail down what is causing the conflicting info from those CBS logs, go back to my Reply #3 and create a bootable Win 7 SP1 disk and perform the offboot sfc /scannow to see what that reports.

Shane · « **Reply #10 on:** January 15, 2015, 04:55:18 pm »

I have been working with another user who had the option features from windows add/remove programs come up with a blank list. I found that it would loop through "C:\windows\Servicing\Packages\" and if it had an error at all it would stop and the list wouldn't load.

So I made a tool to loop through and check for any missing files. None where found, so when I checked the log I found that one of the files in that folder was corrupt. It had all empty data. So when I replaced the file with a good one from my machine the option features list finally worked :-0

So I am writing a tool that will check that folder and check that the files are signed and dont have empty data. I dont have it ready yet, but the reason I tell you this is looking at the log file you posted you do have files missing and or corrupt in the C:\windows\Servicing\Packages\ folder. So once I have this tool done I will have you use it and see what it reports

Shane

Shane · « **Reply #11 on:** January 15, 2015, 07:06:04 pm »

OK here is a test exe I just built, this is for testing only, so please dont anyone keep this as a tool in your toolbox. I will be working on a full version of it and most likely add the tool in the windows repair.

Extract the zip file and make sure to run the file as administrator. This tool will scan through the folder and look for any missing files (It knows what files to look for based on what is stored in the registry) and it will also check each .cat file has a digital cert.

If it finds anything at all just post a screen shot of the program results (No save feature yet)

Shane

Rick · « **Reply #12 on:** January 16, 2015, 04:04:12 am »

Quote from: Shane on January 15, 2015, 07:06:04 pm

OK here is a test exe I just built, this is for testing only, so please dont anyone keep this as a tool in your toolbox. I will be working on a full version of it and most likely add the tool in the windows repair.

Extract the zip file and make sure to run the file as administrator. This tool will scan through the folder and look for any missing files (It knows what files to look for based on what is stored in the registry) and it will also check each .cat file has a digital cert.

If it finds anything at all just post a screen shot of the program results (No save feature yet)

Shane; I always found the only way to fix the CBS log is to rebuild/repair it.
I would only suggest this method rather than try to fish each problem out...
-rick
Shane

jraju · « **Reply #13 on:** January 16, 2015, 06:42:21 am »

Hi, Shane,
Thanks for the attempt. Is this tool for sfc scannow. I do find lot of entries that could not be deciphered that much easily, whether there is any need of repair or not. Some member file could not be reparied and all that, but at the last line, there is a misleading that all the errors are successfully repaired.
Can i check with my cbs.log with this tool. I need your permission to do the same, as it is test exe

Shane · « **Reply #14 on:** January 16, 2015, 02:23:12 pm »

This tool isnt for the cbs logs exactly, it doesnt even touch the log. It is a tool I am making because I found the source of a lot of problems related to the option features list being blank, updates not installing and sometimes sfc errors all trace back to this folder and if any of the files are corrupt or missing.

So I am making a tool to simply help report if it finds anything wrong in that folder is all. This is a new tool I am making and it is still a work in progress

But right now, the cbs log did show files missing from that folder, so I want to see if my tool reports anything.

Shane

Boggin · « **Reply #15 on:** January 16, 2015, 03:21:58 pm »

While I've only had one occasion where an offboot sfc /scannow reported it was unable to repair all files, wouldn't that replace the missing files, or has your curiosity gotten the better off you

Shane · « **Reply #16 on:** January 16, 2015, 03:25:06 pm »

Quote

or has your curiosity gotten the better off you

Always

But in this case, the other person I helped had corrupt files in there and yet sfc reported all files where fine. sfc doesnt scan all the files. A lot of those files in that folder also get added by windows updates. So I dont think sfc covers everything because he ran sfc 4 times on the system and each time it came back saying no corrupt files found.

But sure enough I found the corrupt files, replaced them and it fixed him. Not to mention sfc doesnt check anything in the registry and that folder contents should match a registry section.

So a tool for this can be a big big help. So, I am making one

Shane

Boggin · « **Reply #17 on:** January 16, 2015, 03:43:11 pm »

I always thought that sfc in checking the System did check the registry as that is the "engine" of Windows.

It's obviously finding something wrong in this case whereas the chkdsk doesn't and I've been led to believe that chkdsk looks at more than just the system files ?

Shane · « **Reply #18 on:** January 16, 2015, 03:45:16 pm »

chkdsk scans all files, but not their data, thats what the /r does and why it takes longer. chkdsk checks the files system and the files reported in the mft table. So it makes sure security is in check and pointers to the file locations and such are correct. Very different than sfc. chkdsk is checking the file system not the files and what is corrupt or not.

Shane

Boggin · « **Reply #19 on:** January 16, 2015, 03:48:55 pm »

I was just using chkdsk in its general term without specifying any switches.

Shane · « **Reply #20 on:** January 16, 2015, 03:53:15 pm »

Without any switches is just read only mode, so it still does the same checks as /f but simply doesnt try to do the fixes.

Shane

jraju · « **Reply #21 on:** January 16, 2015, 09:06:25 pm »

Hi, OK.
I will try to run and find the findings and will not use fixes. But avast does not allow this download. It says some evo.gen (sus) and closes and will not allow me to save the files.What to do pl

jraju · « **Reply #22 on:** January 16, 2015, 09:19:20 pm »

Hi, I simply disabled the avast for time being and downloaded and ran. The result is enclosed here. Is this the folder to which windows files are being copied from dvd and updates? very interesting tool.

Shane · « **Reply #23 on:** January 19, 2015, 07:52:04 pm »

This is one of the reason I stopped using avast. The amount of false positives is insane with them and a few others. Anything flagged as a "GEN" stands as generic and is 99% of the time a false positive. It is their so called "Detect new and unknown viruses" feature, and they never, ever work.

So every time I put out a program update they always getting flagged and I have to send it to them and a few others to have them correct the false positive. Seems they auto flag any program made in VB6 for some reason.

Shane

shemaya · « **Reply #24 on:** January 23, 2015, 06:01:54 pm »

hi Shane ran your test exe program and there were no missing or corrupt files listed.
Regards
John