mjhjmtu

root@server1:/ - remote server

/backup1/12/fullbackup - local backup server with data from server1

first i rsync all data from remote server to local backup server (script1.sh):

rsync -avrh -e "ssh -p 123456 -o StrictHostKeyChecking=no" 
--progress 
root@server1:/ /backup1/12/fullbackup/

Second i create simple differential backup script (script2.sh):

today=15 
rsync -avrh -e "ssh -p 123456 -o StrictHostKeyChecking=no" 
--progress 
--link-dest=/backup1/12/fullbackup/
root@$ip:/ /backup1/12/backupday/$today/

After run first script (script1.sh) in directory 12:

# du -sh /backup1/12/*
8.0K /backup1/12/backupday
4.1G /backup1/12/fullbackup

After run second script (script2.sh) all data from fullbackup move to backupday/15

# du -sh /backup1/12/*
3.9G /backup1/12/backupday
386M /backup1/12/fullbackup

After move today=15 to today=16 and run second script again (script2.sh) in backupday:

# du -sh /backup1/12/backupday/*
4.1G /backup1/12/backupday/15
104M /backup1/12/backupday/16

I don't understand why first run script2.sh move all data to backupday/15, and second,third and next run script create correct differential backup.

What needs to change to always have a full copy in /backup1/12/fullbackup, and different in backupday/$today ?

What you are seeing is an artifact of du. When you hard-link files, du keeps a note of the disk usage that has already been accounted for when it comes across the second file. Eg

$ mkdir a b
$ dd count=1000 </dev/zero >a/x
$ ln a/x b/x
$ du -s a b
500 a
0 b
$ du -s b a
500 b
0 a

You see how the first directory gets all the space apparently used.