differential/incremental /var/log backups

[Marcin Owsiany <porridge@debian.org>]

Hi!

Consider the following scenario:

On sunday, you have the following files:
syslog      (from sunday)
syslog.0    (from saturday)
syslog.1.gz (from friday)
syslog.2.gz (from thursday)

Those files get backed up in a level zero backup.

Then, on monday, you have the following files (note the shift):
syslog      (from monday)
syslog.0    (from sunday)
syslog.1.gz (from saturday)
syslog.2.gz (from friday)
syslog.3.gz (from thursday)

Only syslog, syslog.0 and syslog.1.gz get backed up today (a level 1
backup), because only those two files actually changed (appended to or
compressed) since last level 0 backup (just renaming a file doesn't
change its mtime).

On tuesday, there is a system crash, so you restore the files - first
from level zero, and level 1 on top of that. This results in having the
following files:

syslog      (from monday,   from level 1 backup)
syslog.0    (from sunday,   from level 1 backup)
syslog.1.gz (from saturday, from level 1 backup)
syslog.2.gz (from thursday, from level 0 backup)

Ooops, the log from friday got overwritten!

So far I can think of two solutions, but I like neither:
 - backing up WHOLE /var/log every day (level 0 each time) - this means
   larger backups
 - changing traditional rotation (file.number.gz) to something like
   file.year-month-day.gz - this means changing all rotation cronjobs
   or patching logrotate

Has anyone thought of something better?

Marcin
-- 
Marcin Owsiany <porridge@debian.org>             http://marcin.owsiany.pl/
GnuPG: 1024D/60F41216  FE67 DA2D 0ACA FC5E 3F75  D6F6 3A0D 8AA0 60F4 1216