No, that tells you when the new /dev/null got created, not when the real one got deleted (which may have been hours earlier).
Ah, I see. I've two cronjobs already installed and tested (I've two of these machines, same hardware, same snapshot installed, one is far away, the other one is local - which hopefully doubles my chances to catch something). Tas.
