Log levels: nobody agrees what warning means

The levels are only useful if the team shares a definition, and every team discovers it does not during an incident.

the definition that stopped the arguments:

  error     a request failed and a person must look.
            it is on a dashboard and it has an owner.
  warning   something recovered, or degraded, and the
            RATE of it matters. nobody reads individuals.
  info      a business event: an order, a login, a payout.
            queryable, and kept for 90 days.
  debug     off in production. no exceptions.

the test: would you page on a hundred of these in an hour?

Writing the definitions down and putting them next to the logger is worth ten minutes, because the alternative is a system where warning means “I was not sure” and consequently means nothing. The paging test is the useful discriminator. The other rule that helps is that a caught and handled exception is a warning at most — an error implies nobody handled it, and a log full of errors that were in fact handled trains everybody to ignore the level.