Find out which pac files are currently being used

[ade36]

We have several PAC files . I am trying to see how i can figure out which PAC files are still being used or not. Is there a way to know or a log to check to find out?

[fw_mon]

hello @ade36 ,

do you host your proxy.pac files on MWG and serve them using File Server? There are several methods to do this (consult https://community.mcafee.com/t5/Documents/Web-Gateway-Hosting-the-proxy-pac-wpad-dat/ta-p/554253 for more information):

if you serves them directly using port 4713/4714 then you have to modify tomcat logging configuration. The disadvantage of this method is that your settings will be overwritten next time when tomcat get updated

if you using port redirect then you can enable port forwarding logging

if you using Next Hop Proxy mehtod, then all proxy.pac requests are already logged in access.log. You can create a separate access.log for proxy.pac only or use linux command line to filter such requests, cut the name of the proxy.pac file, then apply sort/uniq to see the number of requests to each file.

Describe how you've configured proxy.pac hosting so I can provide exact steps.

[ade36]

thanks . We are using 4713 to serve pac files.

I just need a temporary solution to see which pac files has been accessed .

Do you know what necessary tomcat configuration is needed? or a guide you can show me?

[fw_mon · Accepted solution]

There is another option which is much easier if you need a temporary solution only: capture network traffic on the port 4713, filter the proxy.pac requests and write them into a file. The second command sorts the requests and outputs a statistics that you requested:

tcpdump -pnns0 -i any port 4713 -c 100000 -A | grep "GET http://" > /tmp/proxy.txt

perl -ne 'if(/GET (.*) HTTP/){print "$1\n"}' /tmp/proxy.txt | sort | uniq -c | sort -nr

Good luck!