I have /var/log mounted as separate partition, so trying to umount it gets to:

root@mail:~# umount /var/log
umount: /var/log: target is busy.

Let's look what is blocking it:

lsof | grep 'var/log'

systemd-j 364 root mem REG 8,18 8388608 524326 /var/log/journal/d59b94e79c8c4d78baaa487f78c7f5b1/user-1000 …