logger is the POSIX one-liner that injects a message into the local syslog stream (and therefore into whatever forwarder is shipping it onward — rsyslog, syslog-ng, journald, Beats).
Why it matters to a SOC analyst:
-
Smoke-testing the pipeline (“does my detection rule fire when this message lands?”) without waiting for an organic event.
-
Letting shell scripts and cron jobs emit auditable events with arbitrary facility/severity.
-
Generating training data and SIEM dashboard QA samples.