Comment 18 for bug 1654600

Before=shutdown.target reboot.target halt.target network.target local-fs.target

should be

Before=shutdown.target reboot.target halt.target network.target
After=local-fs.target

because, AIUI, at shutdown, "Before" means "After" and "After" means "Before".

So unattended-upgrades.service's ExecStop'll start before local-fs.target, so before "/var" is unmounted and "/var/log" and "/var/run" are gone.

[Why is "/var/run" used? This is a native Ubuntu package; are there any versions of Ubuntu where "/var/run" isn't a symlink to "/run"?]