{"id":2783,"date":"2013-10-02T00:01:00","date_gmt":"2013-10-02T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/10\/02\/the-admins-first-steps-scan-multiple-event-logs\/"},"modified":"2013-10-02T00:01:00","modified_gmt":"2013-10-02T00:01:00","slug":"the-admins-first-steps-scan-multiple-event-logs","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/the-admins-first-steps-scan-multiple-event-logs\/","title":{"rendered":"The Admin&#8217;s First Steps: Scan Multiple Event Logs"},"content":{"rendered":"<p><strong>Summary<\/strong>: Richard Siddaway talks about using Windows PowerShell to automate scanning event logs across many remote machines.\n<img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" alt=\"Hey, Scripting Guy! Question\">&nbsp;Hey, Scripting Guy! I&rsquo;ve just starting using Windows PowerShell to administer my systems, and I&rsquo;ve been asked to test multiple remote machines for a particular event. How can I do that?\n&mdash;CV\n<img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" alt=\"Hey, Scripting Guy! Answer\">&nbsp;Hello CV,\nHonorary Scripting Guy, Richard Siddaway, here today. I&rsquo;m filling in for my good friend, The Scripting Guy. You&rsquo;re in luck because today I&rsquo;ve got just the answer you are looking for as part of my series of posts about how an administrator can start making productive use of Windows PowerShell.\nEvent logs have been a part of Windows for more years than I care to remember. Books and courses regularly recommend that you check the event logs on a regular basis, but how many administrators have the time to perform this task? Not many, I suspect. The problem is that you have a lot of machines to look after, and it takes time to check the logs on each machine. Time you don&rsquo;t have. This post will explain an easy way to monitor as many logs as you need.\nEvent logs come in two flavors. The standard event logs include:<\/p>\n<ul>\n<li>System<\/li>\n<li>Application<\/li>\n<li>Security<\/li>\n<\/ul>\n<p>They are joined by feature-specific logs, such as DNS and Active Directory.\nWindows Vista introduced the Windows Event Log technology, and then came a whole bunch of extra logs&mdash;243 of them on a Windows Surface RT alone! Each log is dedicated to a specific part of the operating system, such as:<\/p>\n<ul>\n<li>Microsoft-Windows-Audio\/PlaybackManager<\/li>\n<li>Microsoft-Windows-PowerShell\/Operational<\/li>\n<li>Microsoft-Windows-Windows Firewall With Advanced Security\/Firewall<\/li>\n<li>Microsoft-Windows-WinRM\/Operational<\/li>\n<\/ul>\n<p>There is a wealth of data in the new logs, but I&rsquo;m going to concentrate on the classic logs for the rest of this post.\nWindows PowerShell supplies two cmdlets for reading event logs. <strong>Get-EventLog<\/strong> has been with us since Windows PowerShell&nbsp;1.0. It reads the classic event logs. <strong>Get-WinEvent<\/strong> reads both the classic and the new event logs.\nAs an example, I&rsquo;m going to look at the events that are recorded when the event log service starts. This can be taken as an indicator of a machine start up. So counting the number of events of this type in a given time period gives you an indication of how many times the machine has restarted in that period. Let&rsquo;s use a week for the sake of argument:<\/p>\n<p style=\"padding-left: 30px\">Get-EventLog -LogName System -InstanceId 2147489653 -After (Get-Date).Adddays(-7)\nThe log name is specified as is the <strong>InstanceId<\/strong>, which identifies the events you want. The <strong>&ndash;After<\/strong> parameter is supplied a date&mdash;in this case, one week in the past. The big question is, &ldquo;How did I know that I wanted an InstanceId of 2147489653?&rdquo;. Simple. I cheated. I dumped the last day&rsquo;s events and scrolled through them until I found what I needed:<\/p>\n<p style=\"padding-left: 30px\">Get-EventLog -LogName System -After (Get-Date).Adddays(-1)\nOne thing to beware of is that in Windows&nbsp;8 and Windows&nbsp;8.1 systems, when you select Shut down from the power button, the machine doesn&rsquo;t actually shut down. It&rsquo;s in a suspended mode, which is why computers running Windows&nbsp;8 start much faster than those running Windows 7. You will only get an entry in the log when the machine actually restarts.\nAs a quick aside, and I can never resist dipping into WMI. You can test the last boot up time of machine quite simply:<\/p>\n<p style=\"padding-left: 30px\">Get-CimInstance -ClassName Win32_OperatingSystem |<\/p>\n<p style=\"padding-left: 30px\">select -ExpandProperty LastBootUpTime\nI always use the CIM cmdlets if I need to access date information because they convert the date into a readable date for you.\nNow you know how to get the events. How do you count them? I&rsquo;d like to introduce one of the most underused cmdlets: <strong>Measure-Object<\/strong>.<\/p>\n<p style=\"padding-left: 30px\">Get-EventLog -LogName System -InstanceId 2147489653 -After (Get-Date).Adddays(-7) |<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Measure-Object<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">Count&nbsp;&nbsp;&nbsp; : 6<\/p>\n<p style=\"padding-left: 30px\">Average&nbsp; :<\/p>\n<p style=\"padding-left: 30px\">Sum&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :<\/p>\n<p style=\"padding-left: 30px\">Maximum&nbsp; :<\/p>\n<p style=\"padding-left: 30px\">Minimum&nbsp; :<\/p>\n<p style=\"padding-left: 30px\">Property :\nYou only want the count of the objects, so change the code to:<\/p>\n<p style=\"padding-left: 30px\">Get-EventLog -LogName System -InstanceId 2147489653 -After (Get-Date).Adddays(-7) |<\/p>\n<p style=\"padding-left: 30px\">Measure-Object | select -ExpandProperty Count\nOr if you prefer:<\/p>\n<p style=\"padding-left: 30px\">(Get-EventLog -LogName System -InstanceId 2147489653 -After (Get-Date).Adddays(-7) |<\/p>\n<p style=\"padding-left: 30px\">Measure-Object).Count\nWhich one should you use? It&rsquo;s your decision, based on your preferred coding style. I use the first method because it&rsquo;s more obvious to me what I&rsquo;m doing when I come back to read the code in a few months.\nAs an alternative, you can use <strong>Get-WinEvent<\/strong>:<\/p>\n<p style=\"padding-left: 30px\">$filter = @{<\/p>\n<p style=\"padding-left: 30px\">&nbsp;LogName = &#8216;System&#8217;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Id = 6005<\/p>\n<p style=\"padding-left: 30px\">&nbsp;StartTime = (Get-Date).AddDays(-7)<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">Get-WinEvent -FilterHashtable $filter\nThe difference is that you present the filtering information as a hash table. You can find the valid keys in the filter hash table in the TechNet Library: <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/hh849682.aspx\">Get-WinEvent<\/a>. You can also get to them like this:<\/p>\n<p style=\"padding-left: 30px\">get-help get-winevent -online\nUnfortunately, they don&rsquo;t come through with the Help file. For completeness, they are:<\/p>\n<ul>\n<li>LogName=&lt;String[]&gt;<\/li>\n<li>ProviderName=&lt;String[]&gt;<\/li>\n<li>Path=&lt;String[]&gt;<\/li>\n<li>Keywords=&lt;Long[]&gt;<\/li>\n<li>ID=&lt;Int32[]&gt;<\/li>\n<li>Level=&lt;Int32[]&gt;<\/li>\n<li>StartTime=&lt;DateTime&gt;<\/li>\n<li>EndTime=&lt;DataTime&gt;<\/li>\n<li>UserID=&lt;SID&gt;<\/li>\n<li>Data=&lt;String[]&gt;<\/li>\n<li>*=&lt;String[]&gt;<\/li>\n<\/ul>\n<p>In this case, the <strong>StartTime <\/strong>property matches the <strong>&ndash;After<\/strong> parameter in <strong>Get-EventLog<\/strong>, and you use <strong>Id <\/strong>instead of <strong>InstanceId<\/strong>.\nHang on! You&rsquo;re shouting that the numbers are different. Yes, they are, because there are two different sets of identification numbers in the event log data that <strong>Get-EventLog<\/strong> returns:<\/p>\n<ul>\n<li>InstanceId &ndash; usually a big number<\/li>\n<li>EventId &ndash; usually small number<\/li>\n<\/ul>\n<p><strong>Get-WinEvent<\/strong> only returns the <strong>EventId<\/strong>, but as the <strong>Id<\/strong> property. <strong>Get-EventLog<\/strong> doesn&rsquo;t let you filter the <strong>EventId<\/strong> property directly. You could do this:<\/p>\n<p style=\"padding-left: 30px\">Get-EventLog -LogName System -After (Get-Date).Adddays(-7) |<\/p>\n<p style=\"padding-left: 30px\">where EventId -eq 6005\nHowever, it&rsquo;s not as efficient because when you run this against remote machines, you are filtering the client rather than the server.\nThat leads us to working with remote machines, which is where we get the real value. If Windows PowerShell is about anything, it&rsquo;s about the ability for admins to administer tens, hundreds, or thousands of machines remotely.\n<strong>Get-WinEvent<\/strong> and <strong>Get-EventLog<\/strong> have a <strong>ComputerName<\/strong> parameter. <strong>Get-WinEvent<\/strong> doesn&rsquo;t get as much air time as its older sibling, so let&rsquo;s use that. You might come up with something like this:<\/p>\n<p style=\"padding-left: 30px\">$computers = &#8216;server02&#8217;, &#8216;server03&#8217;, &#8216;win12r2&#8217;<\/p>\n<p style=\"padding-left: 30px\">$filter = @{<\/p>\n<p style=\"padding-left: 30px\">&nbsp;LogName = &#8216;System&#8217;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Id = 6005<\/p>\n<p style=\"padding-left: 30px\">&nbsp;StartTime = (Get-Date).AddDays(-7)<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">foreach ($computer in $computers){<\/p>\n<p style=\"padding-left: 30px\">New-Object -TypeName PSObject -Property @{<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Computer = $computer<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Count = Get-WinEvent -FilterHashtable $filter -ComputerName $computer | Measure-Object | select -ExpandProperty Count<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">}\nCreate a list of computers. The filter is the same as before. You use <strong>Foreach<\/strong> to iterate the list of computers. An object is created with two properties: the name of the computer and the count of the events that were discovered. You will get output something like this:<\/p>\n<p style=\"padding-left: 30px\">Count Computer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;&nbsp; &#8212;&#8211; &nbsp;&#8212;&#8212;&#8211;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6 server02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1 server03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4 win12r2&nbsp;&nbsp;\nWell, hopefully not just like this output because it indicates that my machines have restarted up to 6 times in the last week. These results are from my test lab, which I turn off most nights. In a production environment, you would expect 0 or possibly 1 if a restart was necessary for patching. Anything higher than that is a cause for investigation.\nIf you are running Windows Firewall (or any other firewall software) on your servers, you need to ensure that Remote Event Log Management is enabled. As another aside, on computers running Windows Server&nbsp;2012, this is the way to do it:<\/p>\n<p style=\"padding-left: 30px\">Get-NetFirewallRule | where DisplayName -like&nbsp; &#8216;* Event Log*&#8217; | Enable-NetFirewallRule\nThe three rules that get enabled are:<\/p>\n<ul>\n<li>Remote Event Log Management (RPC)<\/li>\n<li>Remote Event Log Management (NP-In)<\/li>\n<li>Remote Event Log Management (RPC-EPMAP)<\/li>\n<\/ul>\n<p>The script is a useful tool, but its main drawback is that it tests each individual machine in sequence.&nbsp; Wouldn&rsquo;t it be nice if you could run the script against multiple machines in parallel? Most of the work is done on the remote machine, so you won&rsquo;t be overloading your admin workstation.\nWindows PowerShell&nbsp;3.0 brought us the ability to work in parallel by using workflows. This task is ideal as a workflow. It hits multiple machines in parallel, and it returns minimal information.<\/p>\n<p style=\"padding-left: 30px\">workflow scaneventlogs {<\/p>\n<p style=\"padding-left: 30px\">param (<\/p>\n<p style=\"padding-left: 30px\">[string[]]$computers<\/p>\n<p style=\"padding-left: 30px\">)<\/p>\n<p style=\"padding-left: 30px\">$filter = @{<\/p>\n<p style=\"padding-left: 30px\">&nbsp;LogName = &#8216;System&#8217;<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Id = 6005<\/p>\n<p style=\"padding-left: 30px\">&nbsp;StartTime = (Get-Date).AddDays(-7)<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">foreach -parallel&nbsp; ($computer in $computers){<\/p>\n<p style=\"padding-left: 30px\">$data = New-Object -TypeName PSObject -Property @{<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Computer = $computer<\/p>\n<p style=\"padding-left: 30px\">&nbsp;Count = Get-WinEvent -FilterHashtable $filter -ComputerName $computer |<\/p>\n<p style=\"padding-left: 30px\">&nbsp; Measure-Object | select -ExpandProperty Count<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">$data<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">}<\/p>\n<p style=\"padding-left: 30px\">&nbsp;<\/p>\n<p style=\"padding-left: 30px\">scaneventlogs -computers &#8216;server02&#8217;, &#8216;server03&#8217;, &#8216;win12r2&#8217;\nNormally, you would expect to use <strong>&ndash;PSComputerName<\/strong> in a workflow, but you need <strong>&ndash;ComputerName<\/strong> in this instance because it is in the property hash table for <strong>New-Object<\/strong>&hellip;simply one of the quirks of workflows that keep us entertained.\nYou will get back something like this for each machine:<\/p>\n<p style=\"padding-left: 30px\">Count&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 4<\/p>\n<p style=\"padding-left: 30px\">Computer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : win12r2<\/p>\n<p style=\"padding-left: 30px\">PSComputerName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : localhost<\/p>\n<p style=\"padding-left: 30px\">PSSourceJobInstanceId : 9c655254-3e8d-420d-9d98-47ad6b34d24c\nYou can live without the last two properties because they show the machine on which the workflow is running and the Windows PowerShell job instance. You can filter them out by changing the last line to this:<\/p>\n<p style=\"padding-left: 30px\">scaneventlogs -computers &#8216;server02&#8217;, &#8216;server03&#8217;, &#8216;win12r2&#8217; | select Computer, Count\nYou could also save the data to a .csv file or a database if required.\nFor more information about workflows, read my series on the Hey, Scripting Guy! Blog:<\/p>\n<p style=\"padding-left: 30px\"><a href=\"http:\/\/blogs.technet.com\/b\/heyscriptingguy\/archive\/tags\/richard+siddaway\/workflow\/\" target=\"_blank\">PowerShell Workflows<\/a>\nYou could develop this idea in multiple ways:<\/p>\n<ul>\n<li>Bring back the date of the event<\/li>\n<li>Get the list of computers from Active Directory or a text file<\/li>\n<li>Test of Active Directory log ons that occur out of hours<\/li>\n<li>Test of the last boot up time (use <strong>Get-CimInstance<\/strong> in the workflow)<\/li>\n<li>Test for Active Directory replication issues<\/li>\n<\/ul>\n<p>If it&rsquo;s in the event logs, you can access it this way.\nCV, that is all there is to using Windows PowerShell to scan event logs on remote machines. Next time I&rsquo;ll have another idea for you to try as you bring automation into your environment.\nBye for now.\n~Richard<\/p>\n<p style=\"padding-left: 30px\">Richard has been working with Microsoft technologies for 25 years and has spent time in most &nbsp;IT roles, including analyst-programmer, server administrator, support, DBA, and architect. He has been interested in automation techniques (including automating job creation and submission on main frames many years ago).&nbsp;He originally used VBScript and WMI since it became available on Windows&nbsp;NT 4.0. Windows PowerShell caught his interest during the early beta versions in 2005.&nbsp;<\/p>\n<p style=\"padding-left: 30px\">Richard blogs extensively about Windows PowerShell and founded the UK Windows PowerShell User Group in 2007. A Windows PowerShell MVP for the last six years, Richard has given numerous talks on Windows PowerShell at various events in the UK, Europe, and the USA. He is frequent speaker for Windows PowerShell User Groups worldwide.<\/p>\n<p style=\"padding-left: 30px\">He has published a number of posts about Windows PowerShell, including expert commentaries on the Microsoft Scripting Games, for which he has been a judge for the last four years. He has written two Windows PowerShell books: Windows PowerShell in Practice (Manning 2010) and Windows PowerShell and WMI (Manning 2012). He then collaborated with Don Jones and Jeff Hicks to write Windows PowerShell in Depth, which was published in 2013. Richard is currently writing an introductory book for Active Directory administrators that features Windows PowerShell.<\/p>\n<p style=\"padding-left: 30px\">Contact information: <a href=\"http:\/\/msmvps.com\/blogs\/RichardSiddaway\/Default.aspx\" target=\"_blank\">Richard Siddaway&#8217;s Blog<\/a>\nThanks, Richard.\nI invite you to follow the Scripting Guys on <a href=\"http:\/\/bit.ly\/scriptingguystwitter\" target=\"_blank\">Twitter<\/a> and <a href=\"http:\/\/bit.ly\/scriptingguysfacebook\" target=\"_blank\">Facebook<\/a>. If you have any questions, send email to me at <a href=\"http:\/\/blogs.technet.commailto:scripter@microsoft.com\" target=\"_blank\">scripter@microsoft.com<\/a>, or post your questions on the <a href=\"http:\/\/bit.ly\/scriptingforum\" target=\"_blank\">Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.\n<strong>Ed Wilson, Microsoft Scripting Guy<\/strong>\n&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: Richard Siddaway talks about using Windows PowerShell to automate scanning event logs across many remote machines. &nbsp;Hey, Scripting Guy! I&rsquo;ve just starting using Windows PowerShell to administer my systems, and I&rsquo;ve been asked to test multiple remote machines for a particular event. How can I do that? &mdash;CV &nbsp;Hello CV, Honorary Scripting Guy, Richard [&hellip;]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[453,97,51,56,189,4,130,45,382],"class_list":["post-2783","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-admin-first-steps","tag-event-logs","tag-getting-started","tag-guest-blogger","tag-richard-siddaway","tag-scripting-techniques","tag-servers","tag-windows-powershell","tag-workflow"],"acf":[],"blog_post_summary":"<p>Summary: Richard Siddaway talks about using Windows PowerShell to automate scanning event logs across many remote machines. &nbsp;Hey, Scripting Guy! I&rsquo;ve just starting using Windows PowerShell to administer my systems, and I&rsquo;ve been asked to test multiple remote machines for a particular event. How can I do that? &mdash;CV &nbsp;Hello CV, Honorary Scripting Guy, Richard [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/2783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=2783"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/2783\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=2783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=2783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=2783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}