{"id":2876,"date":"2017-11-08T12:19:53","date_gmt":"2017-11-08T18:19:53","guid":{"rendered":"https:\/\/kevinjustin.com\/blog\/?p=2876"},"modified":"2019-12-20T12:53:10","modified_gmt":"2019-12-20T16:53:10","slug":"schannel-event-logging","status":"publish","type":"post","link":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/","title":{"rendered":"SCHANNEL event logging"},"content":{"rendered":"

First, my thanks to Bhuvnesh Kumar for his help!<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Time to figure out what’s going on behind the curtain!<\/p>\n

 <\/p>\n

 <\/p>\n

Are you seeing System Event Log, Event ID 36871 events?<\/p>\n

 <\/p>\n

Why does this matter?<\/strong><\/p>\n

 <\/p>\n

Depending on OS versions and patches, the TLS Cipher Suites may not match on the various SCOM servers.<\/p>\n

    \n
  1. If you’re setting up TLS1.2, you need the SCOM servers to talk<\/li>\n
  2. The bad part, is this isn’t logged much on the GW but log more often on MS<\/li>\n
  3. Sometimes the 36871 events come with 36874, but in my experience they occur after Event Logging is enabled.<\/li>\n<\/ol>\n

     <\/p>\n

    The unanswered question is “why are we seeing the 36871 events?”<\/p>\n

     <\/p>\n

    In my example, the events only happened once a day, roughly 24 hours<\/p>\n

     <\/p>\n

    Event Viewer<\/strong><\/p>\n

    \"\"<\/p>\n

     <\/p>\n

    Are events related to the Cipher Suite, or is it a MP trying to run the old SQLOLEDB method?<\/p>\n

     <\/p>\n

    This article will focus on verifying Cipher Suite on a server<\/p>\n

    See this article<\/a> for MP analysis for SQL methods<\/p>\n

     <\/p>\n

     <\/p>\n

     <\/p>\n

    SCHANNEL event logging setup<\/h2>\n

     <\/p>\n

    From Holman’s blog<\/a><\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    Decimal<\/td>\nDescription<\/td>\n<\/tr>\n
    0<\/td>\nDo not log<\/td>\n<\/tr>\n
    1<\/td>\nLog Error messages<\/td>\n<\/tr>\n
    2<\/td>\nLog Warnings<\/td>\n<\/tr>\n
    3<\/td>\nLog Error and Warning messages<\/td>\n<\/tr>\n
    4<\/td>\nLog Informational and Success events<\/td>\n<\/tr>\n
    5<\/td>\nLog Error, Informational and Success events<\/td>\n<\/tr>\n
    6<\/td>\nLog Warnings, Informational and Success events<\/td>\n<\/tr>\n
    7<\/td>\nLog Everything (Warnings, Errors, Informational and Success events<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n

    I\u2019d recommend setting it to 3 to see errors and warnings, or 7 to see everything.<\/p>\n

    Remember to set this back to 1 when done resolving any issues.<\/p>\n

     <\/p>\n

    Add<\/strong><\/p>\n

    From Command Prompt or PowerShell (as administrator)<\/p>\n

    reg add “HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL” \/v “EventLogging” \/t REG_DWORD \/d 7 \/f<\/span><\/p>\n

    Disable<\/strong><\/p>\n

    reg delete “HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL” \/v “EventLogging”<\/span><\/p>\n

    Verification<\/strong><\/p>\n

    reg query “HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL” \/v “EventLogging”<\/span><\/p>\n

     <\/p>\n

    PowerShell verification<\/strong><\/p>\n

    \"\"<\/p>\n

    RegEdit Verification<\/strong><\/p>\n

    \"\"<\/p>\n

    Time to\u00a0reboot!<\/p>\n

     <\/p>\n

     <\/p>\n

    Verify SCHANNEL events<\/h2>\n

    Look at the System Event log, and filter for 36880 and 36874 events for clues<\/p>\n

     <\/p>\n

    36880 provides Cipher Suite details<\/p>\n

    \"\" <\/span><\/p>\n

     <\/p>\n

    Event ID 36874 definitely describes the scenario<\/span>\"\" \"\" <\/span><\/p>\n

     <\/p>\n

    The easy answer to solve the cipher suite is to ask – is this server patched with latest security and .NET patches?<\/p>\n

    After all this, in my example, we confirmed that simple step was assumed, and inaccurate.<\/p>\n

     <\/p>\n

     <\/p>\n

     <\/p>\n

     <\/p>\n

    References<\/strong>
    \n36871 event https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/dn786445(v=ws.11)<\/a><\/p>\n

    SCHANNEL events https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/dn786445(v=ws.11)<\/a><\/p>\n

    SChannel error codes https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/secauthn\/schannel-error-codes-for-tls-and-ssl-alerts<\/a><\/p>\n

    SChannel events https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/dn786445(v=ws.11)<\/a><\/p>\n

    SSL errors https:\/\/www.experts-exchange.com\/questions\/28996780\/event-id-36871-Schannel.html<\/a><\/p>\n

    Troubleshooting https:\/\/docs.microsoft.com\/en-us\/iis\/troubleshoot\/security-issues\/troubleshooting-ssl-related-issues-server-certificate<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    First, my thanks to Bhuvnesh Kumar for his help!   Time to figure out what’s going on behind the curtain!     Are you seeing System Event Log, Event ID 36871 events?   Why does this matter?   Depending on OS versions and patches, the TLS Cipher Suites may not match on the various SCOM … Continue reading “SCHANNEL event logging”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,11],"tags":[27,89,213,341,342,349,445,446,456],"class_list":["post-2876","post","type-post","status-publish","format-standard","hentry","category-administration","category-troubleshooting","tag-admin","tag-cipher-suite","tag-logging","tag-schannel","tag-scom","tag-scom-2016","tag-tls","tag-tls1-2","tag-troubleshooting"],"yoast_head":"\nSCHANNEL event logging - Kevin Justin's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SCHANNEL event logging - Kevin Justin's Blog\" \/>\n<meta property=\"og:description\" content=\"First, my thanks to Bhuvnesh Kumar for his help!   Time to figure out what’s going on behind the curtain!     Are you seeing System Event Log, Event ID 36871 events?   Why does this matter?   Depending on OS versions and patches, the TLS Cipher Suites may not match on the various SCOM … Continue reading "SCHANNEL event logging"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/\" \/>\n<meta property=\"og:site_name\" content=\"Kevin Justin's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-11-08T18:19:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-12-20T16:53:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg\" \/>\n<meta name=\"author\" content=\"Kevin Justin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kevin Justin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/\"},\"author\":{\"name\":\"Kevin Justin\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\"},\"headline\":\"SCHANNEL event logging\",\"datePublished\":\"2017-11-08T18:19:53+00:00\",\"dateModified\":\"2019-12-20T16:53:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/\"},\"wordCount\":459,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/11\\\/Oz-Behind-the-curtain.jpg\",\"keywords\":[\"admin\",\"cipher suite\",\"logging\",\"schannel\",\"SCOM\",\"scom 2016\",\"tls\",\"tls1.2\",\"troubleshooting\"],\"articleSection\":[\"Administration\",\"Troubleshooting\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/\",\"name\":\"SCHANNEL event logging - Kevin Justin's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/11\\\/Oz-Behind-the-curtain.jpg\",\"datePublished\":\"2017-11-08T18:19:53+00:00\",\"dateModified\":\"2019-12-20T16:53:10+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/11\\\/Oz-Behind-the-curtain.jpg\",\"contentUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/11\\\/Oz-Behind-the-curtain.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/11\\\/08\\\/schannel-event-logging\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SCHANNEL event logging\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\",\"name\":\"Kevin Justin's Blog\",\"description\":\"Operational monitoring tools including System Center, Azure Monitor\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\",\"name\":\"Kevin Justin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"caption\":\"Kevin Justin\"},\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/author\\\/kejustin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SCHANNEL event logging - Kevin Justin's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/","og_locale":"en_US","og_type":"article","og_title":"SCHANNEL event logging - Kevin Justin's Blog","og_description":"First, my thanks to Bhuvnesh Kumar for his help!   Time to figure out what’s going on behind the curtain!     Are you seeing System Event Log, Event ID 36871 events?   Why does this matter?   Depending on OS versions and patches, the TLS Cipher Suites may not match on the various SCOM … Continue reading \"SCHANNEL event logging\"","og_url":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/","og_site_name":"Kevin Justin's Blog","article_published_time":"2017-11-08T18:19:53+00:00","article_modified_time":"2019-12-20T16:53:10+00:00","og_image":[{"url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg","type":"","width":"","height":""}],"author":"Kevin Justin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kevin Justin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#article","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/"},"author":{"name":"Kevin Justin","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d"},"headline":"SCHANNEL event logging","datePublished":"2017-11-08T18:19:53+00:00","dateModified":"2019-12-20T16:53:10+00:00","mainEntityOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/"},"wordCount":459,"commentCount":0,"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg","keywords":["admin","cipher suite","logging","schannel","SCOM","scom 2016","tls","tls1.2","troubleshooting"],"articleSection":["Administration","Troubleshooting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/","url":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/","name":"SCHANNEL event logging - Kevin Justin's Blog","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#primaryimage"},"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg","datePublished":"2017-11-08T18:19:53+00:00","dateModified":"2019-12-20T16:53:10+00:00","author":{"@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d"},"breadcrumb":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#primaryimage","url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg","contentUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/11\/Oz-Behind-the-curtain.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/kevinjustin.com\/blog\/2017\/11\/08\/schannel-event-logging\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kevinjustin.com\/blog\/"},{"@type":"ListItem","position":2,"name":"SCHANNEL event logging"}]},{"@type":"WebSite","@id":"https:\/\/kevinjustin.com\/blog\/#website","url":"https:\/\/kevinjustin.com\/blog\/","name":"Kevin Justin's Blog","description":"Operational monitoring tools including System Center, Azure Monitor","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kevinjustin.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d","name":"Kevin Justin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","caption":"Kevin Justin"},"url":"https:\/\/kevinjustin.com\/blog\/author\/kejustin\/"}]}},"_links":{"self":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/2876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/comments?post=2876"}],"version-history":[{"count":3,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/2876\/revisions"}],"predecessor-version":[{"id":6608,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/2876\/revisions\/6608"}],"wp:attachment":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/media?parent=2876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/categories?post=2876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/tags?post=2876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}