You have edited the access log to populate the "s-icap-status" field and want to know the meaning of the possible values.This value is based on the response from the ICAP server.
The possible values for the "s-icap-status" field are:
EXAMPLE:
ICAP_NOT_SCANNED 2017-12-12 08:08:07 4 10.91.17.105 TCP_ACCELERATED - - - - safebrowsing.googleapis.com - 10.91.17.3 - none - - - - none - - 10.91.17.3 SG-HTTP-Service
ICAP_NOT_SCANNED 2017-12-12 08:08:07 2 10.91.17.105 TCP_DENIED - - - - safebrowsing.googleapis.com - - - none - - - - none - - 10.91.17.3 SG-HTTP-Service
EXAMPLE:
ICAP_NO_MODIFICATION 2017-12-12 08:07:28 94 10.91.17.102 TCP_DENIED - - - - www.piriform.com - www.piriform.com - none - - - - none - - 10.91.17.3 SG-HTTP-Service
EXAMPLE:
ICAP_REPLACED 2017-12-12 08:11:39 157 10.91.17.102 TCP_DENIED - - - - www.eicar.org - www.eicar.org - none - - - - none - - 10.91.17.3 SG-HTTP-Service
EXAMPLE:
ICAP_COMMUNICATION_ERROR 2017-12-12 08:10:07 122 10.91.17.102 TCP_DENIED - untrusted-issuer - - 10.91.3.76 - 10.91.3.76 TLSv1 AES128-SHA 128 10.91.3.76 "none" TLSv1 ECDHE-RSA-AES256-SHA 256 - 10.91.17.3 SG-SSL-Proxy-Service
ICAP 500 errors:
scan_timeout, decode_error, password_protected, insufficient_space, max_file_size_exceeded, max_total_size_exceeded, max_total_files_exceeded, file_extension_blocked, antivirus_load_failure, antivirus_license_expired, antivirus_engine_error, connection_failure, request_timeout, internal_error, server_error, server_unavailable.