The code has noticed a condition that may or may not be meaningful—it is not explicitly handled or classified. The correct place the message noting this ought to go could well be unknown. INFO buries it, which may be very bad. Higher severities might be crying wolf. UNKNOWN starts showing up in the logs, that tells you to go take a closer look, and tells you that nobody has encoded the severity of the message into the system.

It could be useful for logging messages that don't fit a particular category, i.e. a catch-all category, to identify patterns over time. Edit: You could also use it to turn-off logging for a while. Since unknown is the highest level, no other logs would be recorded.

Can you give an example of a log message that would not fit typical logging levels? (Info/Debug/Error etc)

I was trying to think of a good example, but the following table from RFC 5424 [1] might be a good starting point. I guess unknown could be used for the top 3 conditions.

           Numerical         Severity
             Code

              0       Emergency: system is unusable
              1       Alert: action must be taken immediately
              2       Critical: critical conditions
              3       Error: error conditions
              4       Warning: warning conditions
              5       Notice: normal but significant condition
              6       Informational: informational messages
              7       Debug: debug-level messages

[1] https://datatracker.ietf.org/doc/html/rfc5424

Based on how it is implemented, it probably should've been called `trace` because it is one level below debug.

possibly the log value was reduced to just a string when it crossed an api boundary or something?