CBS.log is a Windows log file created by the Component-Based Servicing engine, which handles updates, optional features, package installation, and many system file changes. It records detailed servicing events such as applicability checks, file replacements, reboot requirements, and error codes, making it one of the most useful artifacts when a patch does not complete normally.
In cyber security, CBS.log helps defenders separate a genuine servicing problem from a network, proxy, or package-download issue. Administrators often inspect it after failed Windows updates, rollback events, or boot-time servicing errors to see which step broke and why. The log can also reveal evidence of tampering with system components or interference with update mechanisms. When patching fails on a device, CBS.log is often the first place to look for the exact Windows servicing path that ran out of space, hit a missing dependency, or aborted during final installation.