A UPS buys minutes, not a clean shutdown

The beeping box is not a shutdown

Take an invented example, not a real server. A small home server sits on a UPS. The lights fail, the UPS beeps, and the machine keeps writing. Minutes later the UPS goes quiet and the server goes with it. The battery did what a battery does. Nothing told the operating system that the minutes had started.

A UPS keeps the supply alive for a while. It does not finish the shutdown.

The minutes are the product

Network UPS Tools states the software's job: "The whole point of UPS software is to bring down the OS cleanly when you run out of battery power."

APC's Smart-UPS 1200/1500 VA manual, revision A, dated 1 November 2022, says that unit protects equipment from blackouts, brownouts, sags, surges and other utility disturbances, and gives battery backup until utility power is safe again or the batteries are fully discharged.

Interpretation: will this server notice the outage and finish halting inside the runtime it still has?

Someone has to be listening

Network UPS Tools documents USB drivers such as `usbhid-ups`. They ignore the port setting. With a single USB UPS, the driver finds it when the identifiers match. `nut-scanner` can look for USB, SNMP, Eaton XML/HTTP and IPMI devices, and for other NUT servers. The machine that manages the UPS runs `upsmon` as primary. A machine that only watches a NUT server runs it as secondary.

apcupsd is an example for APC units. A USB UPS leaves `DEVICE` blank. A networked one uses the NIS, SNMP or SmartSlot device string that page lists.

NUT's `ups.status` is space-separated tokens. `OL` is line power, `OB` is on battery, `LB` is low battery, and `OL CHRG` is line power while charging. Judgment: a dark room and a status of `OL` means the link failed.

A percentage is not a clock

NUT's `battery.runtime` is seconds. The table's example is 1080. `battery.runtime.low`, example 180, is the runtime left when the UPS calls the battery low. `battery.charge` is a percentage. Schneider's APC VRLA note says runtime falls as load rises, and suggests staying inside 80 percent of rated capacity.

During a power failure, apcupsd shuts down on the first of three. Charge below `BATTERYLEVEL` (default 5 percent). Runtime, as the UPS calculates it, below `MINUTES` (default 3). Or `TIMEOUT` seconds already spent on battery. A Smart-UPS normally uses `TIMEOUT` 0, so charge or runtime decides. A simple UPS that reports neither uses `TIMEOUT` as its limit. The manual's example of 60 forces a test shutdown, and that test does stop the machine.

Some devices raise low battery and switch off almost at once, or raise it as soon as mains fails. `ignorelb` ignores that flag and uses charge below `battery.charge.low`, or runtime below `battery.runtime.low`. The manual's example overrides are 30 and 180, only if those readings are reliable. An override changes the value clients see. The UPS keeps its own. Do not copy 30 or 180.

Batteries age, and the estimate moves

Schneider's APC VRLA FAQ, last modified 17 February 2026, says most APC batteries should last three to five years, less if they run hot or are discharged often. Every 8°C rise cuts life in half on that page: four years at 25°C and about two at 33°C, and the pack inside the UPS is warmer than the room. Replace it before about five years. A Smart-UPS or Back-UPS, the note says, is for an unexpected outage or a short interruption, not repeated deep discharge. Calibrate once or twice a year, and only when needed.

The Smart-UPS 1200/1500 manual says replace that model's battery at least every five years, or earlier if its service life ends or the UPS asks. Short backup can be a weak battery after an outage: charge it, and consider replacing it even if the replace-battery indicator is off.

The Smart-UPS calibration FAQ, last modified 22 April 2026, says the figure on screen depends on load, charge and age. Online it is an estimate. On battery it is more accurate. A calibration drains and recharges the pack, a failing battery can drop the load, and the page caps it at once every six months, for a real problem, in a maintenance window. That cap and the yearly note above are both APC's. When the UPS asks for a new battery, `upsmon` raises `NOTIFY_REPLBATT` every 43200 seconds by default until the request clears.

Prove the shutdown while mains is still up

NUT's test of success is specific. The operating system halts before the battery runs out, and the system restarts when power returns.

`upsdrvctl -t shutdown` prints the sequence and does not call the drivers. `upsmon -c fsd` runs the forced shutdown for real. The computer powers off, may stay off for seconds to minutes, then powers on again. Without `-t`, `upsdrvctl shutdown` will probably cut power to every machine on that UPS. apcupsd's small `TIMEOUT` is a live test too, not a preview.

Judgment, as an example rather than a result: keep a dated note of the token, the runtime, the threshold and what the dry run printed.

Power coming back is a second decision

NUT ends with the utility back, the UPS on, and the systems rebooting. The forced-shutdown flag stays until the data server's daemon restarts. Some devices set it again after wall power returns, if charge is below the vendor's safe level, and stay dark until the pack has charged. Another outage on a flat battery may not leave time for a second clean halt.

`battery.runtime.restart` is the minimum runtime before that restart. The table's example is 120 seconds. `apctest` can program two Smart-UPS EEPROM values that do not themselves change the apcupsd daemon: `WAKEUP`, seconds after the utility returns, and `RETURNCHARGE`, one of 00, 15, 50 or 90. If the load never resets, NUT calls that a power race.

What the minutes do not cover

That manual's protection is electrical, and it stops when the batteries are empty or the utility is safe again. Interpretation: it does not finish a write the operating system never flushed.

A shutdown completes only if runtime remains when the UPS is called critical. `FINALDELAY` defaults to 5 seconds before `SHUTDOWNCMD`, with the battery nearly empty, so do not stretch it. If status stays stale for longer than `DEADTIME`, the UPS is marked dead. If it was last known on battery, that is treated as low battery and can force the halt.

Judgment: the minutes are not a restore. If the halt is late, a backup is not a restore plan until you have restored from it.

This article was drafted with AI assistance and checked against the cited pages on 16 October 2026. It reports no measured outage and no testimonial.

What we would do next

On one server, confirm `OL` on utility power, and write runtime next to the load rather than the percentage alone. Set the threshold from a halt you timed. Run the dry-run display before any command that removes power. Compare the battery's age with that model's replacement guidance, and write down what "power is back" has to look like.

Sources and limits

This article synthesises the sources below into a practical explanation. It is not a security standard, legal advice, or a guarantee that guidance current at review time still applies — check the review date above against your own situation.

1. Configuration notes — Network UPS Tools. Says UPS software exists to bring the OS down cleanly when battery power runs out; describes USB and network monitoring, OL/OB/LB status, the forced-shutdown sequence, and a dry-run before any command that removes power.
2. ups.conf(5) — Network UPS Tools. Documents ignorelb, which replaces the device low-battery flag with charge and runtime thresholds, and says an override changes the value clients see while the UPS keeps its own.
3. upsmon.conf(5) — Network UPS Tools. Documents DEADTIME, FINALDELAY, replace-battery notifications, and the limit that a shutdown can finish only if runtime remains when the UPS is treated as critical.
4. Variables — Network UPS Tools. Defines battery.runtime, battery.runtime.low and battery.runtime.restart in seconds, with the table's own example values.
5. apcupsd.conf(5) — apcupsd. Documents USB and networked attachments, and BATTERYLEVEL, MINUTES and TIMEOUT as the first-match shutdown triggers, plus the Smart-UPS EEPROM delay and charge settings that apctest programs.
6. What is the expected life of my APC UPS VRLA battery? — Schneider Electric. Says most APC batteries last three to five years, that load cuts runtime, that heat and cycling shorten life, and that runtime calibrations are only for when they are necessary.
7. How do I perform a Battery Calibration on my Smart-UPS? — Schneider Electric. Says displayed runtime varies with load, charge and age, that the online figure is an estimate, and that on-battery runtime is more accurate.
8. Operation Manual, APC Smart-UPS 1200/1500 VA, 100/120 Vac — Schneider Electric. Revision A, 1 November 2022. States what that UPS protects against and until when, and says to replace the battery at least every five years or when backup time falls short.

More from Server Attic

• 2026-10-22

  A restart policy is not supervision

  A restart policy brings a container back after it exits. Supervision is the separate work of noticing the repeats, limiting them, and escalating while the process is still failing.

• 2026-08-19

  A health check is not a recovery plan

  A practical home-server guide to separating liveness, readiness and restart signals from the human decisions that make recovery safe.

• 2026-08-07

  A firewall rule is not a network boundary

  A practical OPNsense-inspired checklist for separating trust zones, writing understandable rules, testing the path and keeping a recovery route when a firewall change goes wrong.