Coalescing storage log entries

1. A method, comprising:

receiving an identification of a new primary snapshot created for a primary storage system;

determining a change tracking time window that is at least a portion of a period between a first capture time associated with a previous primary snapshot and a second capture time associated with the new primary snapshot;

analyzing entries of a storage log of the primary storage system occurring within the change tracking time window to coalesce changes identified in the entries of the storage log occurring within the change tracking time window into a change tracking result set, wherein analyzing the entries of the storage log of the storage system occurring within the change tracking time window includes traversing in the new primary snapshot a directory associated with an object linked to an event in the storage log and analyzing the previous primary snapshot to verify the event in the storage log; and

using the change tracking result set to identify at least a portion of data changes between the previous primary snapshot and the new primary snapshot to capture in a new backup snapshot stored at a secondary storage system.

2. The method of claim 1 , wherein the change tracking time window begins at a post-marker occurring after the first capture time associated with the previous primary snapshot and ends at a pre-marker occurring before the second capture time associated with the new primary snapshot.

3. The method of claim 2 , wherein the post-marker that occurred after the first capture time associated with the previous primary snapshot is a particular amount of time from the first capture time.

4. The method of claim 2 , wherein the post-marker that occurred after the first capture time associated with the previous primary snapshot is a timestamp associated with an event included in the storage log that occurred after the previous primary snapshot.

5. The method of claim 2 , wherein the pre-marker that occurred before the second capture time associated with the new primary snapshot is a particular amount of time from the second capture time.

6. The method of claim 2 , wherein the pre-marker that occurred before the second capture time associated with the new primary snapshot is a timestamp associated with an event included in the storage log that occurred before the new primary snapshot.

7. The method of claim 1 , wherein coalescing the changes identified in the entries of the storage log occurring within the change tracking time window includes generating a tree data structure to represent objects having events occurring within the change tracking time window.

8. The method of claim 7 , wherein generating the tree data structure includes processing, in chronological order, the object events occurring within the change tracking time window.

9. The method of claim 7 , wherein the tree data structure includes a plurality of nodes, wherein at least one of the nodes corresponds to an object that is associated with a plurality of events occurring within the change tracking time window.

10. The method of claim 7 , wherein each node included in the tree data structure is associated with a corresponding data structure.

11. The method of claim 10 , wherein a node data structure for a node corresponding to an object stores information that represents the one or more events associated with the node that occurred within the change tracking time window.

12. The method of claim 7 , wherein generating the tree data structure includes constructing corresponding paths for the objects that are associated with the events occurring within the change tracking time window.

13. The method of claim 7 , further comprising publishing the change tracking result set.

14. The method of claim 13 , wherein the published change tracking result set represents a final state of the tree data structure.

15. The method of claim 13 , wherein one or more objects included in the published changed tracking result set are added to a change list.

16. The method of claim 15 , wherein an object is removed from the published change tracking result set in the event the object is associated with a selective directory traversal.

17. The method of claim 1 , further comprising generating an incremental backup of the primary storage system based in part on the change tracking result set.

18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

receiving an identification of a new primary snapshot created for a primary storage system;

determining a change tracking time window that is at least a portion of a period between a first capture time associated with a previous primary snapshot and a second capture time associated with the new primary snapshot;

analyzing entries of a storage log of the primary storage system occurring within the change tracking time window to coalesce changes identified in the entries of the storage log occurring within the change tracking time window into a change tracking result set, wherein analyzing the entries of the storage log of the storage system occurring within the change tracking time window includes traversing in the new primary snapshot a directory associated with an object linked to an event in the storage log and analyzing the previous primary snapshot to verify the event in the storage log; and

using the change tracking result set to identify at least a portion of data changes between the previous primary snapshot and the new primary snapshot to capture in a new backup snapshot stored at a secondary storage system.

19. The computer program product of claim 18 , further comprising computer instructions for generating an incremental backup of the primary storage system based in part on the change tracking result set.

20. A system, comprising:

a processor configured to:

receive an identification of a new primary snapshot created for a primary storage system;

determine a change tracking time window that is at least a portion of a period between a first capture time associated with a previous primary snapshot and a second capture time associated with the new primary snapshot;

analyze entries of a storage log of the primary storage system occurring within the change tracking time window to coalesce changes identified in the entries of the storage log occurring within the change tracking time window into a change tracking result set including by traversing in the new primary snapshot a directory associated with an object linked to an event in the storage log and analyzing the previous primary snapshot to verify the event in the storage log; and

use the change tracking result set to identify at least a portion of data changes between the previous primary snapshot and the new primary snapshot to capture in a new backup snapshot stored at a secondary storage system; and

a memory coupled to the processor and configured to provide the processor with instructions.