syslog remote

logger -n <siem> -P 514 -T 'test'

Sends a test message via syslog to a remote SIEM, verifying that the host's log forwarding works end-to-end.

Run it when you configure or troubleshoot log forwarding from the host to the SIEM: the test message with logger -n confirms that the host reaches the collector, that the port (514 UDP or 514 TCP with -T) is open, and that the SIEM receives and parses the events. It's the validation step for any syslog integration — without this test, the SIEM can be blind to an entire host and nobody notices. In day-to-day SOC operations, it's the tool to answer 'why aren't logs from this host arriving?'.

Don't use it as definitive proof of the entire chain: logger confirms the sending, but not that the SIEM indexes it, parses it, or generates alerts — that's verified in the SIEM with a search for the message. On hosts that already forward with rsyslog/syslog-ng, logger sends directly to the configured destination and the test only confirms the path. And watch out for the port: syslog over UDP (514) gives no delivery confirmation — the message can be silently lost; the TCP variant (-T) at least guarantees the connection. For security logs, consider TLS (6514) instead of classic plaintext syslog.