# Arrange full output capture before a verbose Linux managed Run Command

> DSE recommends deciding the output-retention requirement before launching the command.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:11+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends deciding the output-retention requirement before launching the command.

## Potentially affected

This guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.

## DSE recommendation

DSE recommends deciding the output-retention requirement before launching the command.

## Article

## Source facts

Microsoft limits the output and error fields returned in managed Run Command instanceView to the final four kilobytes. The guide provides output and error blob parameters to forward complete streams to storage append blobs. Deleting a Run Command resource terminates its script if execution is still in progress. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed)

## Applicability

This guide applies to a managed Run Command on an Azure Linux VM when a verbose diagnostic or long-running script needs a complete output record.

## DSE recommendation

DSE recommends deciding the output-retention requirement before launching the command. For a full transcript, configure the documented append-blob destinations and agree who can access them. Review the script for sensitive output and record the VM and command-resource identifiers with the investigation. Keep resource cleanup separate from execution monitoring, particularly when a command is still running and its evidence has not been collected.

## Verification

After the controlled run, inspect the command’s execution result and the intended output destinations. Confirm that both expected streams were captured, including the beginning of the diagnostic output. Record any missing or truncated evidence explicitly. Verify that execution has finished and required output has been retained before carrying out an approved command-resource cleanup.

## Official references

- [Microsoft: Run scripts in a Linux VM in Azure using managed Run Commands – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed)

## Primary reference

- Name: Run scripts in a Linux VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command-managed
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Arrange full output capture before a verbose Linux managed Run Command,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-169-arrange-full-output-capture-before-a-verbose-linux-managed-run-command/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.