logger is the POSIX one-liner that injects a message into the local syslog stream (and therefore into whatever forwarder is shipping it onward — rsyslog, syslog-ng, journald, Beats).
Why it matters to a SOC analyst:
- Smoke-testing the pipeline (“does my detection rule fire when this message lands?”) without waiting for an organic event.
- Letting shell scripts and cron jobs emit auditable events with arbitrary facility/severity.
- Generating training data and SIEM dashboard QA samples.