{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "slug": "dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command", "url": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/" }, "title": "Arrange full output capture before a verbose Linux managed Run Command", "summary": "DSE recommends deciding the output-retention requirement before launching the command.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:11+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 218, "potentially_affected": "This guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.", "dse_recommendation": "DSE recommends deciding the output-retention requirement before launching the command.", "primary_source": { "name": "Run scripts in a Linux VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft limits the output and error fields returned in managed Run Command instanceView to the final four kilobytes. The guide provides output and error blob parameters to forward complete streams to storage append blobs. Deleting a Run Command resource terminates its script if execution is still in progress. Microsoft Learn

\n

Applicability

\n

This guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.

\n

DSE recommendation

\n

DSE recommends deciding the output-retention requirement before launching the command. For a full transcript, configure the documented append-blob destinations and agree who can access them. Review the script for sensitive output and record the VM and command-resource identifiers with the investigation. Keep resource cleanup separate from execution monitoring, particularly when a command is still running and its evidence has not been collected.

\n

Verification

\n

After the controlled run, inspect the command’s execution result and the intended output destinations. Confirm that both expected streams were captured, including the beginning of the diagnostic output. Record any missing or truncated evidence explicitly. Verify that execution has finished and required output has been retained before carrying out an approved command-resource cleanup.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft limits the output and error fields returned in managed Run Command instanceView to the final four kilobytes. The guide provides output and error blob parameters to forward complete streams to storage append blobs. Deleting a Run Command resource terminates its script if execution is still in progress. Microsoft Learn\nApplicability\nThis guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.\nDSE recommendation\nDSE recommends deciding the output-retention requirement before launching the command. For a full transcript, configure the documented append-blob destinations and agree who can access them. Review the script for sensitive output and record the VM and command-resource identifiers with the investigation. Keep resource cleanup separate from execution monitoring, particularly when a command is still running and its evidence has not been collected.\nVerification\nAfter the controlled run, inspect the command’s execution result and the intended output destinations. Confirm that both expected streams were captured, including the beginning of the diagnostic output. Record any missing or truncated evidence explicitly. Verify that execution has finished and required output has been retained before carrying out an approved command-resource cleanup.\nOfficial references\n\nMicrosoft: Run scripts in a Linux VM in Azure using managed Run Commands – Azure Virtual Machines | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft limits the output and error fields returned in managed Run Command instanceView to the final four kilobytes. The guide provides output and error blob parameters to forward complete streams to storage append blobs. Deleting a Run Command resource terminates its script if execution is still in progress. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed)\n\n## Applicability\n\nThis guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.\n\n## DSE recommendation\n\nDSE recommends deciding the output-retention requirement before launching the command. For a full transcript, configure the documented append-blob destinations and agree who can access them. Review the script for sensitive output and record the VM and command-resource identifiers with the investigation. Keep resource cleanup separate from execution monitoring, particularly when a command is still running and its evidence has not been collected.\n\n## Verification\n\nAfter the controlled run, inspect the command’s execution result and the intended output destinations. Confirm that both expected streams were captured, including the beginning of the diagnostic output. Record any missing or truncated evidence explicitly. Verify that execution has finished and required output has been retained before carrying out an approved command-resource cleanup.\n\n## Official references\n\n- [Microsoft: Run scripts in a Linux VM in Azure using managed Run Commands – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "url": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Arrange full output capture before a verbose Linux managed Run Command", "item": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "url": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/", "headline": "Arrange full output capture before a verbose Linux managed Run Command", "description": "DSE recommends deciding the output-retention requirement before launching the command.", "abstract": "DSE recommends deciding the output-retention requirement before launching the command.", "articleBody": "Source facts\nMicrosoft limits the output and error fields returned in managed Run Command instanceView to the final four kilobytes. The guide provides output and error blob parameters to forward complete streams to storage append blobs. Deleting a Run Command resource terminates its script if execution is still in progress. Microsoft Learn\nApplicability\nThis guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.\nDSE recommendation\nDSE recommends deciding the output-retention requirement before launching the command. For a full transcript, configure the documented append-blob destinations and agree who can access them. Review the script for sensitive output and record the VM and command-resource identifiers with the investigation. Keep resource cleanup separate from execution monitoring, particularly when a command is still running and its evidence has not been collected.\nVerification\nAfter the controlled run, inspect the command’s execution result and the intended output destinations. Confirm that both expected streams were captured, including the beginning of the diagnostic output. Record any missing or truncated evidence explicitly. Verify that execution has finished and required output has been retained before carrying out an approved command-resource cleanup.\nOfficial references\n\nMicrosoft: Run scripts in a Linux VM in Azure using managed Run Commands – Azure Virtual Machines | Microsoft Learn", "datePublished": "2026-09-17T16:32:11+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Arrange full output capture before a verbose Linux managed Run Command" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 218, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Run scripts in a Linux VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed" } } ] } }