There is some IBM script out there, which contains a hidden syntax error. I am not sure which script it is (we are still investigating), but most of my HACMP systems (up to version 6.1) showed the symptom and i suspect the source to be in HACMP. Have a look at your system.
Probably someone at IBM had to change a line similar to
redir="/dev/null"
command > "$redir"
and thought it would be a good idea to include a redirection of <stderr> too:
redir="/dev/null 2>&1"
command > "$redir"
What happened now is, that a file called "null 2>&1" is created in "/dev" - and this gets bigger and bigger. "/dev" is in "/" and AIX systems traditionally tend to have fits over full root-fses.
Another thing is a file named "/dev/nulll" (sic! - probably a typo in some script which never surfaced. Hurray for the debugging expertise of the company building the OS we love.) which i also cannot track back to any script.
Since a few days i have a monitoring script in cron, which basically alerts whenever a regular file shows up in "/dev" - regular files have no business being anywhere in "/dev" at all.
find /dev -type f -print | alerting_script.sh
I hope this helps.
bakunin