rsync mirror solution: how to prevent accidental mirror deletion

[Rahul Nabar]

I had a recent disaster scenario with rsync. I was wondering if there
were any suggestions to guard against in the future:

I used to maintain "mirror" backups of the /home dir on our
production_server using rsync to a backup_server.

The primary server had a rsyncd daemon running and the backup_server
had this line in the crontab:

10 01 * * * rsync -av  --delete root at production_server::home
/production_server_home_bkup

Things worked fine and whenever we tested backup_server it always had
a faithful image of the production_server. Unfortunately, one day the
RAID array on primary_server had a failure. As a result /home mount
was lost temporarily. This happened over the weekend and by the time
we got around to checking, the backup_server had a chance to run its
cron job. This job merrily erased every file on the backup since it
thought /home was now supposed to be empty when it synced the two.
Luckily we could recover the RAID so all is well now.

But how should I change our procedures to guard against this (or
similar) outcomes? Is there a better way out for a mirror via rsync?

-- 
Rahul