A teammate argues that a `log.debug("processing order " + order.describe())` line is harmless in production because DEBUG is disabled there — "if it's disabled, nothing happens." Is that true?

Not for this specific line — "disabled" only skips the write, not the work already done to build the message. log.debug("processing order " + order.describe()) concatenates a string and calls order.describe() before debug is even entered, so both run on every call whether or not the level is enabled. SLF4J's placeholder form, log.debug("processing order {}", order), defers the work: the message is assembled only if DEBUG is enabled, and toString() on the argument is never called otherwise. The fix isn't wrapping the call in if (log.isDebugEnabled()) — though that also works — it's passing the object through the placeholder instead of pre-building the string yourself.