We recently updated our ILS and moved to Alma. When setting the new system, the proxy has been enabled on most collections, even on some open access one, resulting in a screen like this being displayed :

As far as I know there is no way to find in the logs when users try to access an host that is not in the list. The solution we have used is to modify the needhost.htm (documentation about these pages) with the following content:

<script type='text/javascript'>
function httpGetAsync(theUrl, callback)
{
    var xmlHttp = new XMLHttpRequest();
    xmlHttp.onreadystatechange = function() { 
        console.log("CHANGE : " + xmlHttp.readyState);
        console.log("CHANGE2 : " + xmlHttp.status);
        if (xmlHttp.readyState == 4) {
                window.location = "^V";
        }
    }
    xmlHttp.open("GET", theUrl, true); // true for asynchronous 
    xmlHttp.send(null);
}

httpGetAsync("http://[myserver]/report_needhost.php?host=" + "^V");
</script>
Si vous n'&ecirc;tes pas redirig&eacute; automatiquement, 
veuillez suivre le lien suivant : <a href='^V'>^V</a>

This page contains a javascript script that will request a php page hosted on another server that will send an email to the administrator email box. The report_needhost.php contains the following code:

<?php
    header('Content-type: text/html; charset=UTF-8');
    $needhost = filter_input(INPUT_GET, 'host');

    $contenu = "Needhost : ".$needhost;
    $headers = "From: [admin email address] <[admin email address]>\n";
    $sujet = "Needhost";
    mail("[admin email address]", $sujet, $contenu, $headers);

Because of CORS the needhost.html won't be able to retreive the result of the report_needhost.php page but the page will still be called and executed, leaving time to the PHP server to send the email.