Note about updating to newer versions: If upgrading to a new version that has the same Major and Minor versions (i.e. the first two digits of the version stamp), you can simply copy over the new binaries on top of the older binaries with these steps:
- run 'net stop azsiem'
- Download the most recent zip file version from above list
- Extract to a different directory
- Copy the files from the new zip over top of the existing files
- Run 'net start azsiem'
This will provide uninterrupted exporting of events

If upgrading to a newer major/minor version, the state and config files of the service will be in a different and incompatible format. We are working on implementing a smooth upgrade approach for this scenario, but currently you'll have to manually uninstall, reinstall, and re-configure the sources. The easiest way to do this is as follows:
- run 'azsiem source list' and make note of the current configured sources
- run 'azsiem uninstall'
- Download the most recent zip file version from above list
- Extract to a different directory
- Change to the new directory and run 'azsiem install'
- You will have to re-add your sources
When you re-add your sources, the defeault 'start time' for exporting events is 15 minutes in the past. If you complete the uninstall / reinstall within 15 minutes, there may be some duplicate exported events. If you wait longer than 15 minutes, you may miss some events unless you add sources specifying an earlier start time. Run 'azsiem source add' to see instructions on how to specify absolute or relative start times.

Contact Mahesh.Nayak@microsoft.com for any questions or assistance