What's important is how your host measures the number of open files. Certainly /proc/sys/fs/file-nr is a great candidate, so +1 for that.
lsof includes "files" not counted in that total, however. I would be surprised if file-nr says that more file handles are open than lsof lists.
The other thing to bear in mind is the size of the file descriptor tables. Each process has a FD table, but there is also a system file table. Your host could have made the (frankly ridiculous) decision to calculate open files by the per-process FD table. You can see this as the FDSize field in /proc/<pid>/status for each process. It has to be a multiple of 2 in size, and is increased in size to the smallest multiple of 2 that will hold all open files. We can sum all of the FDSize entries. Again, this would be an unusual way to measure open files, but other than a process rapidly opening many files that rapidly increases your usage, I can't otherwise explain why their count is so much higher.
I used a script to sum the total FDSize from all open processes, and tried all three counts on two test systems (as root):
$ cat /proc/sys/fs/file-nr
544 0 12640
$ lsof | wc -l
1377
$ find /proc/ -maxdepth 1 -type d -regex '^/proc/[0-9]+$' -exec grep -Hi FDSize '{}'/status \; | cut -f 2 | awk '{total = total + $1}END{print total}'
5888
$ cat /proc/sys/fs/file-nr
8670 0 1587168
$ sudo /usr/sbin/lsof | wc -l
12309
$ find /proc/ -maxdepth 1 -type d -regex '^/proc/[0-9]+$' -exec grep -Hi FDSize '{}'/status \; | cut -f 2 | awk '{total = total + $1}END{print total}'
33088
You may be able to simply ask your host how they measure the open files. Really the FDSize is utter nonsense, I can't imagine they are doing that for real, but it's the only way I can think of to inflate my open files count.
