This article applies as of PRTG 22

Checking content of multipart emails with the IMAP sensor

The internet standard Multipurpose Internet Mail Extensions (MIME), an extension of the original Simple Mail Transfer Protocol (SMTP), allows the transmission of messages containing a multipart body.

A multipart email is recognized as one if the content type indication contains the word “multipart”. There are different types of multipart messages, for example multipart/digest, multipart/mixed, multipart/parallel, multipart/related or multipart/alternative. The different parts of a multipart message are typically delimited by long, random character strings called "boundaries".

A multipart/alternative email, for example, contains the same information coded in different ways in its alternative parts.

It can look like this (we surrounded our comments with ### to help you better find your way through this multipart email):

Content-Type: multipart/alternative;

 boundary=--boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 
###Boundary Identifier of the Multipart Email###

----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 
###Alternative 1 of Boundary x-x-x-x-891c660d3750###

Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

=0D=0AUhrzeit: Today at 04:28 , Successful Offsite Copy auralisSt=
B , Copied 178,7 MB (compressed to 17,64 MB) for 4 files. (Durati=
on: 1 minute),=0D=0A=0D=0A=0D=0A

----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 
###Alternative 2 of Boundary x-x-x-x-891c660d3750###

Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Today at 04:28: (auralisStB) Successful Offsite Copy - Copied 178=
,7 MB (compressed to 17,64 MB) for 4 files. (Duration: 1 minute)=0D=0A=
=0D=0A

----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 
###Alternative 3 of Boundary x-x-x-x-891c660d3750###

Content-Type: multipart/related; type="text/html";
 boundary=--boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570

----boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570

Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64

DQpVaHJ6ZWl0OiBUb2RheSBhdCAwNDoyOCAsIFN1Y2Nlc3NmdWwgT2Zmc2l0ZSBDb3B5
IGF1cmFsaXNTdEIgLCBDb3BpZWQgMTc4LDcgTUIgKGNvbXByZXNzZWQgdG8gMTcsNjQg
TUIpIGZvciA0IGZpbGVzLiAoRHVyYXRpb246IDEgbWludXRlKSwNCg0KDQo=

----boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570--

----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750-- 
###End of Boundary x-x-x-x-891c660d3750###

Additionally, the content or text types are indicated, like text/plain, text/html or image/png.

The IMAP sensor can scan the different parts of a multipart email for a certain keyword. You just have to add this sensor to a device that represents your mailbox and the sensor checks all incoming emails as well as multipart messages. For example, you can define that the sensor searches for the string “Backup succeeded” in emails from certain backup services in your network. This way, you can monitor if your backups succeeded the night before.

Note: At least one part in your multipart email must be encoded quoted-printable so that the keyword string search can be successfully completed. If you want the IMAP sensor to look for the string “Backup succeeded” in a base64-encoded multipart, it will not be able to find it, because it will look like this: QmFja3VwIHN1Y2NlZWRlZA==.

Note: If your emails contain an HTML body, it can be convenient to use regular expressions when searching for keywords. See My IMAP sensor does not process HTML emails correctly using regex. What can I do?.