LFCS 149 🐧 Backup with rsync - KandZ

⏱️ Estimated read: 9 min | |

The previous chapter covered tar as the archiver for backups. This chapter covers rsync, which is the synchronization tool for backups. The distinction matters: tar produces a single archive file that must be extracted to be useful. rsync produces a mirror of the source directory that is immediately usable. The LFCS exam tests the rsync syntax for backups, the --delete flag for mirroring, the --exclude flag for skipping files, and the -a flag for preserving attributes. The critical trap is the trailing slash on the source path. The rsync /src /dest/ copies the src directory into /dest/src/. The rsync /src/ /dest/ copies the contents of src into /dest/. This is the most common source of unexpected directory nesting.

Key point: The rsync -a flag is the archive mode: it preserves permissions, timestamps, symbolic links, and ownership. The -v flag is verbose. The -z flag compresses during transfer. The --delete flag removes files from the destination that are not in the source. The --exclude flag skips matching files. The -n or --dry-run flag previews the transfer without making changes. The -P flag combines --partial and --progress.

Why rsync requires a specific mental model

The trailing slash problem. The source path with a trailing slash means “the contents of this directory.” The source path without a trailing slash means “this directory itself.” The rsync -av /home/user /backup/ creates the /backup/user/ directory with the contents of /home/user/. The rsync -av /home/user/ /backup/ copies the contents of /home/user/ directly into /backup/, with no user/ subdirectory. This distinction is the most common source of unintended directory nesting, and it is the first thing the exam tests.

The mirror versus copy problem. A copy adds and updates files but never removes them. A mirror makes the destination an exact replica of the source, including the removal of files that no longer exist in the source. The --delete flag is the mirror switch. Without it, the backup grows over time with the files that the source has removed. With it, the backup is a true snapshot of the current state, but a wrong source path can delete the entire destination.

The dry-run problem. The --delete flag is destructive. The -n (or --dry-run) flag previews the transfer without making changes. The output shows which files would be transferred, which would be deleted, and which are already up to date. The dry run is the mandatory step before any --delete backup.

The permission problem. The -a flag preserves the permissions, the ownership, the group, and the timestamps. The ownership preservation requires root. A regular user cannot set the ownership of the files to another user. The --no-o and --no-g flags disable the ownership and group preservation, which is the correct setting for a user-level backup.

The incremental problem. The rsync transfers only the differences between the source and the destination. The first run is a full copy. The subsequent runs transfer only the changed files. The --link-dest flag goes further: it creates hard links for the unchanged files, which results in a full snapshot that consumes the storage of only the changed files. This is the snapshot-style backup.

The trade-off. The rsync backup is faster for the incremental runs and produces a usable mirror. The tar backup is a single file, which is easier to transfer to an off-site location but requires extraction to be useful. The correct choice depends on whether the backup is for the fast recovery or for the archival storage.

a. The basic backup with rsync

The rsync -av command is the standard backup. The -a is the archive mode, and the -v is the verbose output.

# Backup the home directory (contents)
rsync -av /home/user/ /backup/home/

# Backup the home directory (including the directory itself)
rsync -av /home/user /backup/

The first form creates /backup/home/ with the contents of /home/user/. The second form creates /backup/user/ with the same contents. The difference is the trailing slash.

The -z flag compresses the data during transfer, which is useful for remote backups.

# Remote backup with compression
rsync -avz /home/user/ user@backup-server:/backup/home/

The -z reduces the network usage, but it adds the CPU overhead on both ends. For the local transfers, the -z has no effect and is omitted.

b. The mirror with `--delete`

The --delete flag removes the files from the destination that are not in the source. The --dry-run flag previews the changes.

# Dry run with delete
rsync -avn --delete /home/user/ /backup/home/

# Real run with delete
rsync -av --delete /home/user/ /backup/home/

The dry-run output shows the deleting lines for the files that would be removed. The >f lines show the files that would be transferred. The *deleting prefix is the indicator of the deletion.

The --delete-excluded flag is different. It removes the files from the destination that are excluded from the transfer. The --delete flag only removes the files that are missing from the source. The --delete-excluded removes the excluded files as well.

# Delete excluded files too
rsync -av --delete --delete-excluded --exclude='*.tmp' /home/user/ /backup/home/

c. The exclusions, the partial transfers, and the hard links

The --exclude flag skips the matching files. The --exclude-from reads the patterns from a file.

# Exclude cache and temp files
rsync -av --exclude='.cache' --exclude='*.tmp' /home/user/ /backup/home/

# Exclude from a file
rsync -av --exclude-from=/backup/exclude.txt /home/user/ /backup/home/

The -P flag combines the --partial and --progress. The --partial keeps the partially transferred files, which allows the resume of an interrupted transfer. The --progress shows the transfer progress.

# Resume and progress
rsync -avP /home/user/large-file.iso user@backup-server:/backup/

The --link-dest flag creates the hard links for the unchanged files. The result is a full backup that looks like a complete copy, but the unchanged files share the inodes with the reference directory.

# Snapshot backup with hard links
rsync -av --link-dest=/backup/latest /home/user/ /backup/2026-10-30/
ln -sfn /backup/2026-10-30 /backup/latest

The --link-dest compares the files with the reference directory. The unchanged files are hard-linked, and the changed files are copied. The ln -sfn updates the latest symlink to the new backup. The next backup uses the new directory as the reference.

Complete Example Session

# ============================================
# PART 1: BASIC BACKUP
# ============================================

rsync -av /home/user/ /backup/home/
# Copies the contents of /home/user/ to /backup/home/.

# ============================================
# PART 2: TRAILING SLASH
# ============================================

rsync -av /home/user /backup/
# Creates /backup/user/ (directory itself).

# ============================================
# PART 3: DRY RUN WITH DELETE
# ============================================

rsync -avn --delete /home/user/ /backup/home/
# Shows what would be transferred and deleted.

# ============================================
# PART 4: REAL DELETE
# ============================================

rsync -av --delete /home/user/ /backup/home/
# Files in /backup/home/ not in /home/user/ are removed.

# ============================================
# PART 5: EXCLUDE
# ============================================

rsync -av --exclude='.cache' --exclude='*.tmp' /home/user/ /backup/home/

# ============================================
# PART 6: REMOTE BACKUP
# ============================================

rsync -avz /home/user/ user@backup-server:/backup/home/

# ============================================
# PART 7: RESUME WITH -P
# ============================================

rsync -avP /home/user/large-file.iso user@backup-server:/backup/

# ============================================
# PART 8: SNAPSHOT WITH --link-dest
# ============================================

rsync -av --link-dest=/backup/latest /home/user/ /backup/2026-10-30/
ln -sfn /backup/2026-10-30 /backup/latest

# ============================================
# PART 9: VERIFY
# ============================================

diff -r /home/user/ /backup/home/
# No output: the directories are identical.

The nine parts trace the rsync backup: basic backup, trailing slash, dry run, real delete, exclude, remote, resume, snapshot, and verification.

Quick Reference

Common Flags

Flag	Purpose
`-a`	Archive mode (preserves attributes)
`-v`	Verbose
`-z`	Compression
`-n`	Dry run
`--delete`	Remove destination files not in source
`--exclude`	Skip pattern
`--exclude-from`	Skip from file
`-P`	Partial + progress
`--link-dest`	Hard-link unchanged files

Archive Components

Flag	Meaning
`-r`	Recursive
`-l`	Preserve symlinks
`-p`	Preserve permissions
`-t`	Preserve times
`-g`	Preserve group
`-o`	Preserve owner
`-D`	Preserve devices

Trailing Slash

Source	Result
`/home/user/`	Contents in destination
`/home/user`	Directory itself in destination

Remote Format

Format	Meaning
`user@host:/path`	Remote destination
`user@host:/path/`	Remote destination (contents)

Best Practices

✅ Do This:

rsync -avn --delete /home/user/ /backup/home/
<!-- Dry run before the real transfer -->             # ✅

rsync -av --link-dest=/backup/latest /home/user/ /backup/2026-10-30/
<!-- Use hard links for the snapshot -->              # ✅

diff -r /home/user/ /backup/home/
<!-- Verify the backup after the transfer -->         # ✅

❌ Don’t Do This:

rsync -av /home/user /backup/home/
<!-- Creates /backup/home/user/ -->                   # ❌

rsync -av --delete /home/user/ /backup/home/
# Without the dry run
<!-- Deletes files without preview -->                # ❌

rsync -av /proc/ /backup/proc/
<!-- Virtual filesystem causes errors -->             # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Nested directory created	Missing trailing slash	Add `/` to source
Files deleted unexpectedly	`--delete` without dry run	Use `-n` first
Ownership not preserved	Remote user not root	Use `--no-o --no-g`
Slow transfer	No compression	Add `-z`
Interrupted transfer restarts	No `-P`	Add `-P`

Real-World Examples

1. Basic Backup

rsync -av /home/user/ /backup/home/

2. Mirror with Delete

rsync -av --delete /home/user/ /backup/home/

3. Dry Run

rsync -avn --delete /home/user/ /backup/home/

4. Remote Backup

rsync -avz /home/user/ user@backup-server:/backup/home/

5. Exclude

rsync -av --exclude='.cache' /home/user/ /backup/home/

6. Resume

rsync -avP /home/user/large.iso user@backup-server:/backup/

7. Snapshot

rsync -av --link-dest=/backup/latest /home/user/ /backup/2026-10-30/

8. Update Latest

ln -sfn /backup/2026-10-30 /backup/latest

9. Verify

diff -r /home/user/ /backup/home/

10. User Backup

rsync -av --no-o --no-g /home/user/ /backup/home/

Visual

Trailing Slash

┌──────────────────────────────────────────────┐
│  rsync -av /home/user/ /backup/home/         │
│  → copies contents                          │
│  → /backup/home/file1.txt                   │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  rsync -av /home/user /backup/home/          │
│  → copies directory                         │
│  → /backup/home/user/file1.txt              │
└──────────────────────────────────────────────┘

Mirror with –delete

┌──────────────────────────────────────────────┐
│  Source: /home/user/                         │
│  ├── file1.txt                               │
│  └── file2.txt                               │
└──────────────────┬───────────────────────────┘
                   │
                   │ rsync -av --delete
                   ▼
┌──────────────────────────────────────────────┐
│  Destination: /backup/home/                  │
│  ├── file1.txt                               │
│  ├── file2.txt                               │
│  └── old-file.txt (deleted)                  │
└──────────────────────────────────────────────┘

Summary

Item	Value
Archive mode	`-a`
Verbose	`-v`
Compression	`-z`
Dry run	`-n`
Delete	`--delete`
Exclude	`--exclude`
Resume	`-P`
Hard links	`--link-dest`
Trailing slash	`/src/` copies contents
Remote	`user@host:/path`

Key takeaways:

The trailing slash is the trap. The rsync /src/ /dest/ copies the contents. The rsync /src /dest/ copies the directory itself. The difference is the leading src/ directory in the destination.
The --delete flag makes the backup a mirror. It removes files from the destination that are not in the source. The -n dry run is mandatory before the real transfer.
The -a flag preserves the attributes. It is the shortcut for -rlptgoD. The ownership preservation requires root. The --no-o and --no-g flags are the user-level alternative.
The --link-dest creates the snapshot. It hard-links the unchanged files, so the full backup consumes only the size of the changes. The ln -sfn updates the latest link.
The diff -r is the verification. It compares the source and the destination and shows any difference. A backup without a verification is a backup that might not be complete.

Remember: rsync is the synchronization tool. The -a is the archive. The -v is the verbose. The -z is the compression. The -n is the dry run. The --delete is the mirror. The --link-dest is the snapshot. The trailing slash is the trap. The exam tests the syntax and the trailing slash.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Why rsync requires a specific mental model

a. The basic backup with rsync

b. The mirror with --delete

c. The exclusions, the partial transfers, and the hard links

Complete Example Session

Quick Reference

Common Flags

Archive Components

Trailing Slash

Remote Format

Best Practices

Common Pitfalls

Real-World Examples

1. Basic Backup

2. Mirror with Delete

3. Dry Run

4. Remote Backup

5. Exclude

6. Resume

7. Snapshot

8. Update Latest

9. Verify

10. User Backup

Visual

Trailing Slash

Mirror with –delete

Summary

b. The mirror with `--delete`