Do a "cat /dev/null" when it is a regular file (as root, we can see the permissions are tight).. The contents of the file may give a clue as to the last process that (successfully) wrote to /dev/null.
I'll do that as soon as the problem shows up again, and I'll try to force that, but if it stays as "stable" as over the last two weeks, it'll take another two weeks... Anyway, I'll post the file content as soon as I have it. Tas.
