This article explains how to verify whether Juniper Secure Analytics (JSA) can successfully connect to updates.maxmind.com to update geographic data using MaxMind's GeoLite2 database.

• Geographic data in reports shows excessive entries under "Other" or lacks location details.
• GeoIP updates do not seem to be applied even after configuration. 
• Running the geodata update script results in a message indicating updates are skipped.

To verify the JSA connectivity to updates.maxmind.com and its update status, run the following Geo update command from the JSA console.

# /opt/qradar/bin/geodata_update.sh

Executing geoipupdate tool

Copying downloaded GeoLite2-City database to /store/configservices/staging/globalconfig

Checking if database GeoLite2-City has been updated

GeoLite2-City database has been updated

GEODATA_AUTOMATIC_DEPLOY=0, so GeoLite2-City database is staged until next full deploy.

 Note 1: After a successful update, the JSA Console GUI will display:

"There are undeployed changes. Click 'Deploy Changes' to deploy them. View Details

Note: A full configuration deployment is required for these changes to take effect. Once you click Deploy Changes, the full configuration deployment will be performed automatically."

Note 2: If you see the following message when running the Geo update command, it indicates that "Disable Automatic Content Update" is set to TRUE.

# /opt/qradar/bin/geodata_update.sh

/opt/qradar/conf/GeoIP.conf DisableSelect is set to true, skipping update

To resolve this issue, follow these steps:

1. Set "Disable Automatic Content Update" to FALSE in the JSA UI.
2. Deploy the changes.
3. Re-run the geodata_update.sh command.