UPS Network Management Cards and SNMP Monitoring

What a management card actually is

A network management card is a self-contained embedded computer that slides into an expansion slot on the back of a UPS. It has its own Ethernet port and IP address, reads UPS data over the slot's internal interface, and offers that data to the network in several ways. Because it is powered by the UPS, it keeps working on battery and does not depend on any server staying up.

Some newer UPS models have a network port built in rather than a slot, and some offer cloud monitoring through the vendor. The concepts below apply to all of them.

What the card gives you

• Web interface for status, event logs, self-test scheduling, outlet group control and UPS settings.
• Alerts by email, syslog and SNMP traps, independent of any server.
• SNMP polling for monitoring systems such as Zabbix, LibreNMS, PRTG or Prometheus via an SNMP exporter.
• Shutdown signaling to client agents on each protected server.
• Environmental sensors on many cards: temperature and humidity probes in the rack.
• Outlet group control on UPS models that support switched outlet groups: remote reboot of a hung device, staggered power-on.

SNMP in five minutes

SNMP organizes values in a tree of numeric object identifiers (OIDs). A MIB file maps names to OIDs. For UPS units there are two layers:

• UPS-MIB, RFC 1628. A vendor-neutral standard under 1.3.6.1.2.1.33. Most cards implement at least part of it, so a generic monitoring template can read battery status, runtime and output source from any brand.
• Vendor MIBs. Richer and brand specific, for example APC's PowerNet MIB. They expose details the standard omits, such as battery replacement dates, outlet groups and sensor probes.

Testing from a Linux machine with the net-snmp tools:

# SNMPv2c, read-only community (replace with yours)
snmpget -v2c -c your-ro-community 192.168.50.5 1.3.6.1.2.1.33.1.2.3.0
snmpwalk -v2c -c your-ro-community 192.168.50.5 1.3.6.1.2.1.33

# SNMPv3 with authentication and privacy
snmpget -v3 -l authPriv -u monitor -a SHA -A 'auth-pass' -x AES -X 'priv-pass' \
    192.168.50.5 1.3.6.1.2.1.33.1.4.1.0

Many cards ship with SNMP disabled or limited to specific managers. Enable the version you need and add your monitoring host's address to the card's access list before testing.

Using a card with Network UPS Tools

NUT's snmp-ups driver turns a card into a regular NUT UPS. A Linux box, NAS or hypervisor runs the driver and server, and every other machine follows it as a NUT client exactly as if the UPS were on USB.

# /etc/nut/ups.conf, SNMPv2c
[rackups]
    driver = snmp-ups
    port = 192.168.50.5
    community = your-ro-community
    snmp_version = v2c
    mibs = auto
    desc = "Rack UPS via management card"

# SNMPv3 variant
[rackups]
    driver = snmp-ups
    port = 192.168.50.5
    snmp_version = v3
    secLevel = authPriv
    secName = monitor
    authProtocol = SHA
    authPassword = auth-pass
    privProtocol = AES
    privPassword = priv-pass
    mibs = auto

Check with upsc rackups@localhost. If mibs = auto picks a generic mapping that lacks details, the driver documentation lists named mappings (such as apcc for APC or ietf for the standard MIB) you can set explicitly. Some Eaton cards also support XML-based drivers in NUT; check the hardware compatibility list for your card. Full NUT setup is covered in the NUT guide, and Proxmox-specific clients in Proxmox UPS shutdown.

Card or USB plus a NUT server?

Shutdown clients: how the signal reaches each server

The card never shuts anything down by itself. It publishes state, and each protected machine runs something that listens. There are two broad models:

• Vendor agents. Each server runs the vendor's network shutdown client, registered with the card. The card tells clients when to shut down and can wait for them before turning off outlet groups. These agents often integrate with hypervisor management (for example, migrating or shutting down VMs) and are the supported path for vendor support cases.
• One NUT server polling the card. A single Linux machine or NAS runs snmp-ups and upsd; every other machine is a NUT secondary. This is brand-agnostic and fits mixed environments, but it reintroduces a dependency on that one poller.

Some environments use both: vendor agents on hypervisors, and NUT for everything else. That works as long as each machine has exactly one thing deciding when it shuts down.

Timing with outlet groups

UPS models with switchable outlet groups let the card turn groups off in sequence: for example, non-critical gear early in an outage to extend runtime for the core switch and storage. Coordinate the group turn-off delays with client shutdown times, so a group never goes dark while its servers are still stopping. Write the plan down in a short table alongside the rack documentation; it is the first thing anyone will need during an incident.

Securing the card

A management card is a networked device with the power to switch off your equipment. Treat it like any other infrastructure device.

1. Change default credentials on first login. Cards historically shipped with well-known default usernames and passwords; newer firmware often forces a change.
2. Disable what you do not use: SNMPv1, Telnet, FTP and plain HTTP where HTTPS and SSH are available.
3. Do not use "public" or "private" as SNMP communities. Prefer SNMPv3 with authentication and privacy.
4. Restrict access with the card's access list and put it on a management VLAN that ordinary clients and the internet cannot reach.
5. Update firmware. UPS management interfaces, including major brands' cards, have had publicly disclosed vulnerabilities over the years. Check the vendor's security notices and CISA advisories periodically.
6. Send logs off the card via syslog, so events survive a card reset.

Physical and network checklist

• Plug the switch port that serves the card into a battery-backed circuit, or the card goes silent exactly when it matters.
• Give the card a static address or DHCP reservation so clients do not lose it.
• Set the card's clock via NTP, so event timestamps line up with server logs.
• Record the card's MAC address and firmware version with your rack documentation; see rack-mount UPS installation.

For a broader view of where cards fit among other tools, see the UPS software overview and UPS for a network rack.