With the IMAP sensor, I can check the content of emails for certain keywords. Does this work with multipart emails, too?
This article applies as of PRTG 22
Checking content of multipart emails with the IMAP sensor
The internet standard Multipurpose Internet Mail Extensions (MIME), an extension of the original Simple Mail Transfer Protocol (SMTP), allows the transmission of messages containing a multipart body.
A multipart email is recognized as one if the content type indication contains the word “multipart”. There are different types of multipart messages, for example multipart/digest, multipart/mixed, multipart/parallel, multipart/related or multipart/alternative. The different parts of a multipart message are typically delimited by long, random character strings called "boundaries".
A multipart/alternative email, for example, contains the same information coded in different ways in its alternative parts.
It can look like this (we surrounded our comments with ### to help you better find your way through this multipart email):
Content-Type: multipart/alternative; boundary=--boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 ###Boundary Identifier of the Multipart Email### ----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 ###Alternative 1 of Boundary x-x-x-x-891c660d3750### Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable =0D=0AUhrzeit: Today at 04:28 , Successful Offsite Copy auralisSt= B , Copied 178,7 MB (compressed to 17,64 MB) for 4 files. (Durati= on: 1 minute),=0D=0A=0D=0A=0D=0A ----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 ###Alternative 2 of Boundary x-x-x-x-891c660d3750### Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Today at 04:28: (auralisStB) Successful Offsite Copy - Copied 178= ,7 MB (compressed to 17,64 MB) for 4 files. (Duration: 1 minute)=0D=0A= =0D=0A ----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750 ###Alternative 3 of Boundary x-x-x-x-891c660d3750### Content-Type: multipart/related; type="text/html"; boundary=--boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570 ----boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 DQpVaHJ6ZWl0OiBUb2RheSBhdCAwNDoyOCAsIFN1Y2Nlc3NmdWwgT2Zmc2l0ZSBDb3B5 IGF1cmFsaXNTdEIgLCBDb3BpZWQgMTc4LDcgTUIgKGNvbXByZXNzZWQgdG8gMTcsNjQg TUIpIGZvciA0IGZpbGVzLiAoRHVyYXRpb246IDEgbWludXRlKSwNCg0KDQo= ----boundary_31_9360943d-f5bd-488e-8c49-43bef58a7570-- ----boundary_30_78fd8c46-4719-46d9-8686-891c660d3750-- ###End of Boundary x-x-x-x-891c660d3750###
Additionally, the content or text types are indicated, like text/plain, text/html or image/png.
The IMAP sensor can scan the different parts of a multipart email for a certain keyword. You just have to add this sensor to a device that represents your mailbox and the sensor checks all incoming emails as well as multipart messages. For example, you can define that the sensor searches for the string “Backup succeeded” in emails from certain backup services in your network. This way, you can monitor if your backups succeeded the night before.
Note: At least one part in your multipart email must be encoded quoted-printable so that the keyword string search can be successfully completed. If you want the IMAP sensor to look for the string “Backup succeeded” in a base64-encoded multipart, it will not be able to find it, because it will look like this: QmFja3VwIHN1Y2NlZWRlZA==.
Note: If your emails contain an HTML body, it can be convenient to use regular expressions when searching for keywords. See My IMAP sensor does not process HTML emails correctly using regex. What can I do?.
Created on Mar 4, 2015 8:24:33 AM by
Martina Wittmann [Paessler Support]
Last change on Dec 29, 2022 10:25:42 AM by
Brandy Greger [Paessler Support]
Please log in or register to enter your reply.