Oh yeah, a really stupid question. Why not just count the number of entries in /proc/####/fd? Wouldn't that quickly tell you which process has thousands of open file descriptors?