I used refractasnapshot to make a snapshot of my running system, which worked well so far.
I can't start tor, which i have installed, because it can't create a log file in /var/log/tor on it's own.
In the excludes list is a similar note about clamav.
27 #- /var/log/*
28 # The next three lines exclude everything in /var/log
29 # except /var/log/clamav/ (or anything else beginning with "c") and
30 # /var/log/gdm (or anything beginning with "g").
31 # If clamav log files are excluded, freshclam will give errors at boot.
32 - /var/log/[a-b,A-Z]*
33 - /var/log/[d-f]*
34 - /var/log/[h-z]*
As far i can see right now (still fiddling).