[frostschutz]

Updated it; it now puts the info in /mnt/onboard/.usbdebug/

and also can be uninstalled if you create /mnt/onboard/.usbdebug/uninstall

sample output

umount failure /mnt/onboard Thu Aug 6 23:41:31 CEST 2015

/proc/869/cwd 4096 8 41ed 0 0 b303 346 3 0 0 1438732800 1438794482 1438794482 4096

init(1)-+-adobehost-launc(832)---adobehost(833)---{QProcessManage}(844)
        |-autoshelf.sh(2455)-+-cat(2459)
        |                    `-dd(2460)
        |-dbus-daemon(524)
        |-dbus-daemon(523)
        |-fickel-launcher(917)---fickel(918)
        |-getty(529)
        |-hindenburg(525)
        |-inetd(531)
        |-nickel(526)-+-sh(2431)---usb(2432)---sleep(2453)
        |             |-{FifoHardwareSt}(815)
        |             |-{QEvdevTouchScr}(828)
        |             |-{QProcessManage}(813)
        |             |-{QThread}(824)
        |             |-{QThread}(825)
        |             |-{QThread}(829)
        |             |-{QThread}(830)
        |             |-{Qt HTTP thread}(925)
        |             |-{Qt bearer thre}(826)
        |             |-{nickel}(928)
        |             `-{nickel}(930)
        |-screensaver.sh(702)-+-grep(858)
        |                     |-logread(857)
        |                     `-screensaver.sh(860)
        |-sickel(879)
        |-swapper(208)
        |-syslogd(821)
        |-udevd(495)
        |-usbdebug.sh(2457)---pstree(2768)
        `-webportal.sh(717)---httpd(869)

so it failed to umount, due to process 869 (which blocks /mnt/onboard by using it as a current working directory [cwd] and in the pstree you can see 869 is httpd so the culprit in this case is my webportal mod (which I still have to fix)