Note about updating to newer versions: If upgrading to a new version that has
the same Major and Minor versions (i.e. the first two digits of the version
stamp), you can simply copy over the new binaries on top of the older binaries
with these steps:
- run 'net stop azsiem'
- Download the most recent zip file version from above list
- Extract to a different directory
- Copy the files from the new zip over top of the existing files
- Run 'net start azsiem'
This will provide uninterrupted exporting of events
If upgrading to a newer major/minor version, the state and config files of the
service will be in a different and incompatible format. We are working on
implementing a smooth upgrade approach for this scenario, but currently you'll
have to manually uninstall, reinstall, and re-configure the sources. The
easiest way to do this is as follows:
- run 'azsiem source list' and make note of the current configured sources
- run 'azsiem uninstall'
- Download the most recent zip file version from above list
- Extract to a different directory
- Change to the new directory and run 'azsiem install'
- You will have to re-add your sources
When you re-add your sources, the defeault 'start time' for exporting events is
15 minutes in the past. If you complete the uninstall / reinstall within
15 minutes, there may be some duplicate exported events. If you wait longer
than 15 minutes, you may miss some events unless you add sources specifying an
earlier start time. Run 'azsiem source add' to see instructions on how to
specify absolute or relative start times.
Contact Mahesh.Nayak@microsoft.com for any questions or assistance