On a 16.04 and newer systems, unattended-upgrades runs daily at a random time.
How to tell when unattended upgrades will run today:
The random time is set by a cron job (/etc/cron.daily/apt.compat), and you can read the random time for today by asking systemd:
$ systemctl list-timers apt-daily.timer
NEXT LEFT LAST PASSED UNIT ACTIVATES
Tue 2017-07-11 01:53:29 CDT 13h left Mon 2017-07-10 11:22:40 CDT 1h 9min ago apt-daily.timer apt-daily.service
In this case, you can see that u-u ran 1 hour and 9 minutes ago.
How to tell if unattended upgrades are still running:
One easy way is to check the timestamp files for the various apt components:
$ ls -l /var/lib/apt/periodic/
-rw-r--r-- 1 root root 0 Jul 10 11:24 unattended-upgrades-stamp
-rw-r--r-- 1 root root 0 Jul 10 11:23 update-stamp
-rw-r--r-- 1 root root 0 Jul 10 11:24 update-success-stamp
-rw-r--r-- 1 root root 0 Jul 10 11:24 upgrade-stamp
You can see here that u-u is just another apt component. apt places the timestamp here regardless of how the apt was started.
Putting the data together, you can see that the timer started apt (u-u) at 11:22. It ran an update which completed at 11:23, then an upgrade which completed at 11:24. Finally, you can see that apt considered the upgrade to be a success (no error or other failure).
Obviously, if you see a recent timer without a corresponding completion timestamp, then you might want to check
ps to see if apt is still running.
How to tell which step apt is running right now:
One easy way is to check the u-u logfile.
$ less /var/log/unattended-upgrades/unattended-upgrades.log
2017-07-10 11:23:00,348 INFO Initial blacklisted packages:
2017-07-10 11:23:00,349 INFO Initial whitelisted packages:
2017-07-10 11:23:00,349 INFO Starting unattended upgrades script
2017-07-10 11:23:00,349 INFO Allowed origins are: ['o=Ubuntu,a=zesty-security', 'o=Ubuntu,a=zesty-updates']
2017-07-10 11:23:10,485 INFO Packages that will be upgraded: apport apport-gtk libpoppler-glib8 libpoppler-qt5-1 libpoppler64 poppler-utils python3-apport python3-problem-report
2017-07-10 11:23:10,485 INFO Writing dpkg log to '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log'
2017-07-10 11:24:20,419 INFO All upgrades installed
Here you can see the normal daily process, including the 'started' and 'completed' lines, and the list of packages that were about to be upgraded.
If the list of packages is not logged yet, then apt can be safely interrupted. Once the list of packages is logged, DO NOT interrupt apt.
Since you have a resource-constrained environment, be aware that apt can be configured many ways to work reliably and unobtrusively with different run times, nice levels, bandwidth limits, and many other useful settings.