1 of 1 people found this helpful
I checked all they systems that were patched and have specifically narrowed the problem down to only Windows Server 2008 R2 Standard with SP1.
I have come across a couple of different articles that are describing the problem as Windows problem. It appears that the underlining “Windows Update” and/or “Windows Module Installer” services creates the temp files then trues to zip (mabecab.exe) them into a file that it stores in the C:\Windows\Logs\CBS folder. For some reason the process broke after my machines were patched with Shavlik and the system was unable to create the zip file anymore but it decided to keep trying every 1 hour adding more and more files to the C:\Windows\Temp folder.
I’m come up with a process that seem to successfully delete the old information allowing windows to create the zip file properly again. It's been a number of hours and it appears to be working but I will keep monitoring the situation and then check after I patch these machines with Shavlik again to be sure.
Here are the steps that I followed:
- Delete all files in C:\windows\temp (this is where the .cab files were stored)
- Open “Services.msc” and stop the “Windows Update” service
- Rename the C:\Windows\SoftwareDistribution folder to C:\Windows\SoftwareDistribution.old
- Start the “Windows Update” service
- This will create a new C:\Windows\SoftwareDistribution folder
- Delete the C:\Windows\SoftwareDistribution.old folder.
- This folder contains all previously downloaded Windows updates
- Windows is unaware that Shavlik had patched these machines and still thinks it need to install old downloaded updated. This process deleted those old updates.
- Once deleted it, Window update will check itself and WSUS for only the latest patches
- Stop the service “Windows Modules Installer” service
- Navigated to the C:\Windows\Logs\CBS folder and deleted all the files
- If CBS.log doesn’t delete, check the “Windows Module Installer” service again as it auto-restarts pretty quickly
That should been it. I'm not scheduled to patch my machines again for another couple of weeks so I'll follow up on this post then.
Thanks for posting a possible solution to this, I'm sure it will be helpful for admins encountering the same issue. I look forward to your follow-up.
It's been 20ish hours since I did the process to try and fix it an new .cab files have NOT reappeared in the C:\Windows\Temp folder. the C:\Windows\Logs\CBS folder only contains a .log file (which is about 40 minutes old on average) and no other files so I'm thinking it worked. Again I still need to patch with Shavlik to be sure the issue doesn't return.
I am having this exact same issues wanted to see if you have any updates on your above fix above, and did it cause any negative issues?
I am seeing this same symptom in regards to my Slow Patching post. Maybe that's what is killing my performance on deployment. Will report back.
EDIT: Indeed it was the issue. 52 patches still installing after 18 hours. After this solution, 14 patches in 4 minutes.
I've tried upgrading from version 9.1 to 9.2 with no luck. I'm currently working with support but it looks like the issue is triggered after a scan (based on the creation date of the files). Once I follow the work around above it doesn't appear to be happening to the same server again but I have 600 servers I'm patching.
one other thing I need to test / verify is if a server has Windows Updates set to "Automatic" or "Never Check for Updates" to see if that makes a difference.
Seems like this can happen any time both WSUS and Shavlik are in use. We use both. And just because you fixed it doesn't mean it won't come back later on.
We are working to automate both the discovery and fixing of the issue. Servers may be found and fixed by their owners each cycle, but our client machines will otherwise never be discovered and fixed.
Those were the steps I indicated would clear out the issue. At this point I'm trying to confirm if it stay fixed. I'm patching over 600 machines so manually doing this process isn't really an option. I could script something out to do it but I would rather understand why it's happening and figure out a way to prevent it from happening.
Did you have any luck with this issue? We are experiencing it in our environment. We are looking for a permanent fix.
We have had the same issue. When we turned WSUS off it took care of the issue.