GeoIP databases are used under SkyATP and Security Director (LC) for deriving IP to Country Mappings.

This article helps answer the following questions:

• Which database is used in SkyATP for GeoIP feeds?
• Which database is used in Security Director (LC) while populating report for IP to country mapping in version 16.1? 

If these are out of sync, discrepancies may be seen in reports compared to the policy enforced for GeoIP.

Both applications use https://www.maxmind.com GeoIP database for IP to Country Mapping.

The following databases are used:

• SkyATP uses GeoIP2 DB: IP to Country mapping.

• SD/LC uses GeoLiteCity (But SD/LC uses only Country information from this DB)

Note: Upgrading “GeoLiteCity” database across new releases are only done in SD/LC.

To perform manual upgrade of Log Collector GeoIP DB on version 16.1 and higher, take the following steps:

1. Download DB
   curl -O  http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

2. Unzip       
   gunzip GeoLiteCity.dat.gz

3. Take Backup
   cp /opt/jIngest/config/GeoLiteCity.dat /opt/jIngest/config/GeoLiteCity.dat.old

4. Update new
   cp GeoLiteCity.dat /opt/jIngest/config/GeoLiteCity.dat

5. Restart service
   service jingest restart