You need to know if your Network Prevent for Web detection server is receiving any ICAP traffic at all for detection, or you need to see if specific URLs are making it to the detection server at all, before any detection takes place.
Activate ICAP tracing will show all traffic arriving on the detection server, regardless of policies or incident detection. To activate it,
The traces will be generated in the "Icap.TraceFolder". It will have a filename as "timestamp-conn_id". The first line of the trace file provide information about connecting host IP and port along with timestamp. Data read from wire will follow format "<< timestamp no_of_bytes_read". Data written on wire will follow format ">> timestamp no_of bytes_written". The last line should have connection closed being reported.
NOTE: The amount of data generated on enabling traces will be huge. Make sure you have good amount of free space available on disk. Also the content written in file is in clear text.
For more Web Prevent Diagnostics and Troubleshooting refer to this Note: