Windows CBS (Component-Based Servicing) log
Windows servicing log (CBS.log / CbsPersist*.log). Surfaces component-store corruption, SFC/DISM repair activity, and servicing outcomes. High-volume routine narration is dropped at collection, including the per-package applicability census (installed-update inventory answers which updates are present). Narration that is kept lands at Debug, progress summaries at Verbose, and outcomes at their own severity. Query at severity >= Info for normal investigation, and drop to Verbose or Debug inside a known servicing window.
Feed id: win.servicing.cbs.
Channels
This feed reads a servicing log file on the endpoint rather than an event channel. Each reason below names the file it was read from.
Fields
| Field | Type | Unit | Meaning |
|---|---|---|---|
win.servicing.cbs.component | string | CBS log component column (CBS, CSI, DPX, SXS, WCP, SQM, DEPLOY, DMI, PnP). | |
win.servicing.cbs.detected_corruption | int | Total Detected Corruption count from a DISM scan-summary line. | |
win.servicing.cbs.repaired_corruption | int | Total Repaired Corruption count from a DISM scan-summary line. | |
win.servicing.cbs.corrupt_component | string | WinSxS component family of a corrupt payload (e.g. userexperience-oobe). Aggregate query-side. | |
win.servicing.cbs.corrupt_file | string | Corrupt payload file path from a CSI Payload Corrupt line. | |
win.servicing.cbs.unrepairable_file | string | A file CSI could not repair, from an Unable to repair payload file line. |
Curated reasons
Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.
win_component_store_assembly_missing
A component assembly is missing from the store.
Severity: Notice
Impact: Windows will usually repair this automatically.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_corruption
The Windows component store is corrupt.
Also reported by: Windows Setup event log
Severity: Warning or Notice
Impact: Servicing operations and updates may fail until the store is repaired. The scan_found arm alone does not mean anything is currently broken; package_blocked means a specific update did not apply.
Log file: C:\Windows\Logs\CBS\CBS.log
| Case | Severity | Ticket class |
|---|---|---|
scan_found | Notice | patching |
operation_failed | Warning | patching |
package_blocked | Warning | patching |
recovered | Notice | patching |
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_corruption_recurring
Windows reported how often component-store corruption has been detected.
Severity: Notice
Impact: None directly. A rising count suggests the underlying cause is not being fixed.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_file_flag_corruption_suspected
Windows suspects component-store file-flag corruption.
Severity: Notice
Impact: None established. The event records a suspicion, not a finding.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_file_repaired
Windows repaired a file from its component store or backup.
Severity: Notice
Impact: None. The file was restored.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_payload_corrupt
A payload file in the component store is corrupt.
Severity: Notice
Impact: Windows will usually repair this automatically.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_payload_unrepairable
Windows could not repair a damaged payload file.
Severity: Warning
Impact: Servicing operations needing this payload will fail until it is restored.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_repair_unavailable
Windows could not repair a damaged component.
Severity: Warning
Impact: Updates touching this component are likely to fail until it is repaired manually.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_reprojection_failed
Windows could not reproject a component.
Severity: Notice
Impact: Usually none: the operation is normally retried.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_component_store_scan_repaired_corruption
A component-store scan repaired corruption it found.
Severity: Notice
Impact: None. The damage was fixed.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_commit_skipped_reboot_required
A servicing change was deferred because a reboot is pending.
Severity: Notice
Impact: The change applies after the next reboot.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_component_manifest_unreadable
A component manifest is malformed.
Severity: Notice
Impact: Operations touching that component may fail.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_delta_patch_failed
A component delta patch could not be applied.
Severity: Notice
Impact: Usually none: Windows falls back to a full payload.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_duplicate_update_name
Windows found a duplicate update name in a package.
Severity: Notice
Impact: None established. It may indicate a store inconsistency.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_package_manifest_unreadable
Windows could not parse a package manifest.
Severity: Debug
Impact: That optional feature may not be installable.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_package_stage_failed
A Windows package could not be staged for installation.
Severity: Warning
Impact: That update will not install until the underlying cause is fixed.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_source_files_missing
A servicing operation could not find the source files it needed.
Also reported by: Windows DISM servicing log
Severity: Warning
Impact: Repair or install will keep failing until a valid source is supplied.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_startup_package_failed
A Windows package failed during startup processing.
Severity: Notice
Impact: That package is not installed. Patching status is better read from the update client.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_servicing_update_package_create_failed
Windows could not create an update package.
Severity: Warning
Impact: That update will not install until the underlying cause is fixed.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
win_sfc_repair_started
System File Checker started repairing components.
Severity: Notice
Impact: None on its own.
Log file: C:\Windows\Logs\CBS\CBS.log
Fields it can set: win.servicing.cbs.component, win.servicing.cbs.corrupt_component, win.servicing.cbs.corrupt_file, win.servicing.cbs.detected_corruption, win.servicing.cbs.repaired_corruption, win.servicing.cbs.unrepairable_file
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.