This article applies as of PRTG 22

Update: As of PRTG 16.3.26, we optimized the IMAP sensor settings usage. The look of the settings changed, but the functionalities remain the same. Running IMAP sensors that have already existed in your installation before the update to PRTG 16.3.26 or later correctly transfer the settings, so you do not have to change anything.

Monitoring backup solutions via email

The subject backup is getting more and more complicated for service companies with many customers as well as for end-user companies: there are many kinds of backup solutions, the amount of data is rising, and so on. In companies of all sizes, the kinds of backup solutions vary:

• Backups in the area of virtualization, for example, Veeam
• Additional backups of the operating system, for example, complete images, SQL backup, Exchange backups, and much more
• Tape backups, for example, CA ARCserve, Symantec Backup Exec, and so on
• Online backups

With these various options, it is difficult to keep an overview of what is going on with your backups.

Email notifications as common ground

Most backup services can send email notifications to inform you about the status of the last backup. Though, with a certain amount of backups to be checked, it is not practicable to manually analyze every email for malfunctioning backups day by day. You will need a system that displays all backup jobs at a glance and indicates if they succeeded or not.

Monitoring backups with PRTG

Because email notifications are considered to be common ground for different backup solutions, they are a universal method of centrally receiving status messages of almost every backup job. With PRTG, you will not need to check all individual emails that your backups send to your personal inbox anymore. PRTG will analyze these emails for you and keep track of all your backup jobs.

The IMAP sensor has specific filter options and automatically runs through your emails, checking them for keywords in the subject line and in the text. Also, it can notify the responsible person if no emails have been received by a backup during a certain time span. You will know that everything is fine with your backups as long as the IMAP sensors show the Up status.

You only need two things to set up backup monitoring with PRTG:

1. Configure your backup software to send emails to a dedicated email account.
2. Configure the IMAP sensor so it checks your backup mails.

Click to enlarge.

Use case scenario

You are running two different backup solutions. Both send emails to your in-house mail server with information about their respective backup status. Now you would like PRTG to regularly retrieve the emails to check them for keywords. You want PRTG to show you the backup status as well as trigger an alert if there has not been any incoming email during the last 24 hours.

The necessary steps to take for this scenario are as follows:

Step 1: Configure your backup solution

Your backup software must be enabled to send emails. Furthermore, we recommend that there is one dedicated email account for each of your backup solutions. In this use case scenario, you will need two dedicated email accounts on your in-house email server. These accounts must be accessible via IMAP.

Emails sent by your backup software most likely look like this:

Click to enlarge.

Click to enlarge.

Click to enlarge.

Step 2: Configure IMAP sensor in PRTG

1. Create a new device in PRTG for your mail server. Add a new device to the desired group, for example, by clicking Add Device in its context menu.
   
   
   Click to enlarge.
2. In the Add Device dialog, enter a suitable name and the corresponding IPv4 Address/DNS Name of your email server. Click OK.
   
   
   Click to enlarge.
3. Add two IMAP sensors, one for each of your email accounts on the email server. For example, right-click the new device and select Add Sensor from the context menu. In the Add sensor dialog, search for IMAP. Click the box that shows the IMAP sensor.
   
   
   Click to enlarge.
4. In the Add Sensor dialog, enter a suitable Sensor Name. You can leave section Connectivity unchanged for the moment (in previous PRTG versions, this was section IMAP Specific).
5. In the Sensor Behavior section, set Email Processing to Process emails in the mailbox (in previous PRTG versions, this was Process Email Content in section Identify Email).
6. The Authentication section will open. Enter the credentials (User Name and Password) for the respective mailbox. Enter the Folder Name of the corresponding mailbox (this was in section Identify Email in previous PRTG versions).
   
   
   Click to enlarge.
7. In section Filter Emails in Inbox (section Identify Emails in previous PRTG versions), you can leave most filter settings unchanged at Do not check because you use only one dedicated email account per backup. You can adjust the option Only Include Recent Emails, though.
   
   Select Emails must be younger than. Because we would like to trigger an alert if there has not been any incoming backup email for the last 24 hours, enter 24 into the Maximum Age (Hours) field and select Set sensor to down status for If No Email Matches the Above Filters. (In previous PRTG versions, this was the setting Check Last Message Date with Check for new messages received within the last x hours entered into the Error Threshold (Hours) field.)
   
   
   Click to enlarge.
8. In the Validate Latest Email section, customize your filters for warnings and alarms. In our use case, we want sensors that show the Up status if the backup job succeeded and warnings for backup emails containing both “error” and “partially” in the subject. Additionally, we want the Down status only for emails containing “error” in the subject. If we get an email with any other text, but without the word “success”, this is an unknown email and indicates an error. We want the sensor to show the Down status in this case, too.
   • For Set Sensor to "Warning" Status, select If subject contains and Regular expression as Search Method. To match subjects like the one in our example (ERROR: Backup backup_xyz is partially successful), use the following regular expression (regex): (?=.*\berror\b)(?=.*\bpartially\b).*
   • This regex finds matches containing the words error and partially in any order. Enter a Warning Message for this case.
   • To get the Warning status for messages that are too old, select If email is older than for Based on Message Age, Set Sensor to "Warning" Status. Enter a number of hours without any backup email into the Message Age in Hours field to receive an additional Warning status.
   • For Set Sensor to "Down" Status, select If subject does not contain and Simple string search as Search Method. Enter success into the Search String field. This sensor behavior defines that if there is no (sub)string success in the subject line, the sensor changes to the Down status. Enter an Error Message for this case.
     
     
     Click to enlarge.
     
     (Note: In previous PRTG versions, you had to set No Matching Mail Behavior to None, so if none of the defined filter matched, everything would be fine and the sensor would stay in the Up status.)
9. Click Continue.
10. Repeat these configuration steps for your second IMAP sensor.
    PRTG immediately starts monitoring your backups.
    
    • Note: Of course, you can also define filters for the body of your backup emails.

Step 3: Test your configuration

To test your configuration, send some test emails to the accounts you use for your backups. Try several subjects, for example:

• try a subject that simulates a successful backup,
• try a subject for which you want PRTG to show the Warning status,
• try to trigger the Down status, for example, by using an error term without “partially”, and by using some other text, for example, “Acronis True Image Notification from exchanger.johnqpublic.com”.

Using one mailbox only for several backup services

For an easier setup, we recommend that you use separate dedicated mailboxes, one for each backup service. However, it is possible to monitor several backup services within one mailbox. This means that all of your backup solutions will send emails to the same target address. However, each of your solutions will use a different from address, or at least a unique identifier in the subject field.

To set up monitoring for this scenario, you need specific criteria in your sensor settings to identify the emails. You can either use a specific sender (from) address, an ID, or a URL. In any case, you need one IMAP sensor for every backup job, and each of these sensors will query the same IMAP mailbox.

1. Configure the IMAP sensor as above.
2. Under Filter Emails in Inbox, configure the criteria how the sensor will discern emails. Use the Only Include Emails with fields. For example, if backup mails from [email protected] are to be analyzed, select Check using simple string search in Only Include Emails with Matching "From", and enter this email address. The sensor will now ignore emails from other addresses.
3. If the backup emails contain an ID or a different distinctive term in the subject, for example, Backup successful (ID 12345), you can use Only Include Emails with Matching "Subject" the same way. (In previous PRTG versions, use the Identify by fields.)

Debugging

If your IMAP sensors do not work as expected, ensure that the following requirements are met:

• Your IMAP mailbox receives emails from your backup software.
• You entered the correct credentials in PRTG for your IMAP mailbox. Make sure that PRTG can log in.
• You correctly set the email content filters. In particular, ensure that you use the correct syntax for regular expressions. If you have any doubts about what they are matching, check your regex with a regex tester like REGex TESTER.
• The error and warning thresholds of your IMAP sensors are correctly set.

Note: We strongly recommend that you set up a mailbox that is only used for monitoring. If a user connects to this mailbox via any email client or web interface, the IMAP sensor is not able to correctly calculate the last message date and will therefore likely send false alarms, particularly when using error thresholds.