Over the years, I've had many times when some file gets removed and there's no obvious culprit.  With dtrace, it is somewhat easy to figure out:

 #! /usr/sbin/dtrace -wqs

syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) == "/dev/null"/
{
        stop();
        printf("%s[%d] stopped before removing /dev/null\n", execname, pid);
        system("ptree %d; pstack %d", pid, pid);
}

That script will stop the process trying to remove /dev/null before it does it.  You can allow it to continue by restarting (unstopping?) the command with prun(1) or killing it with kill -9.  If you want the command to continue automatically after getting the ptree and pstack output, you can add "; prun %d" and another pid argument to the system() call.