Suricata

The "geoip" keyword functionality depends on the now discontinued GeoIP Legacy Free Database format. Maxmind, the creator and owner of the database, has removed the legacy-format GeoIP database files from their download site as of January 2, 2019 and now provides only the newer GeoIP2 format files with the "*.mmdb" database extension. This new format is different from, and incompatible with, that of the GeoIP library and database currently used by Suricata.

The new GeoIP2 format requires use of the libmaxminddb library and its API. Details can be found here: https://github.com/maxmind/libmaxminddb/blob/master/doc/libmaxminddb.md

The legacy format GeoIP database files have been removed from the Maxmind web site and are no longer available. See this post: https://support.maxmind.com/geolite-legacy-discontinuation-notice/

Without a changeover to the new Maxmind DB library, the geoip keyword will cease to function since the required database is no longer available.