ulimit nofiles and lsof

If I do an

lsof | grep user | wc -l

I get a number returned in the 25,000 range.

If I check

ulimit -a user

nofiles is set at 1024.

Can someone help me to understand the number of open files setting better? Clearly it’s not the case, but I thought a hard nofiles of 1024 meant a user can’t have more than 1024 open files.

The file limit returned by ulimit is the number of files that can be opened by a single process (ulimit -n to only see number of descriptors). The value returned is the RLIMIT_NOFILE (or man getrlimit), described in man ulimit. This small application will output the same value (1024):

#include <stdio.h>
#include <sys/time.h>
#include <sys/resource.h>

int main(){
    struct rlimit info;
    getrlimit(RLIMIT_NOFILE, &info);
    printf("%dn", info.rlim_cur);
    return 0;
}

You are probably counting a lot of duplicate files. Try

lsof -u <user> | grep "/" |sort -k9 -u | wc

which should filter out some of the non-file descriptors and the duplicate file entries. I stole this answer from an identical questions on Serverfault.