by Ken Task.
incremental backups are backups that contains only those files that have been altered since the last full backup or that's kinda how that term is defined. So the --delete option would do that .... and think you'd want that.
Maybe think of this as a mirror of the active/production server files to another location - that other location could be a different directory on same server or to a directory on a remote server.
If a new file exist in /my/server/directory then it is sync'd in /my/backup/directory.
If a file exist in /my/backup/directory that *no longer* exist in /my/server/directory then it is removed in /my/backup/directory.
There would be references to filedir files and trashdir files - those two directories being considered the most important in moodledata for backups.
There is an option for --dry-run which just runs through what rsync would have done and gives you a chance to see what would have occurred. Sounds like you might have run the rsync the first time without --delete then ran it again with the --delete option. That's a guess.
As per: https://linux.die.net/man/1/rsync
Think the hardest thing to remember about rsync (and I have to look this up every time) is what you want to do ... as it relates to SRC (source) and DEST (destination).
Local: rsync [OPTION...] SRC... [DEST] Access via remote shell: Pull: rsync [OPTION...] [USER@]HOST:SRC... [DEST] Push: rsync [OPTION...] SRC... [USER@]HOST:DEST
Others might disagree, but if rsyncing to another server would think rsyncing as root would allow the freedom to archive just about anywhere on the DEST box.
'spirit of sharing', Ken