You get one of the following SCOM alerts:
– Content Synchronization
– Catalog Synchronization

Further investigations

The WsusUtil tool

In a command prompt, go to the WSUS tools directory and use the wsusutil command with the checkhealth parameter.
Please note that this command must be run directly on the server,
and will return an error if you run it in a PSSession.

Set-Location -Path 'C:\Program Files\Update Services\Tools'
& .\WsusUtil.exe CheckHealth

Synchronisation history

Personally I use cmdlets from PoshWSUS, an excellent module from Boe Prox, a Microsoft MVP, which is available in the PowerShell Gallery.

Install-Module -Name PoshWSUS

Once the module is installed on your server, you must connect to the WSUS service.

Import-Module -Name PoshWSUS
Connect-PSWSUSServer -WsusServer MyWSUSServer -Port 8530

Now you can use the Get-PSWSUSSyncHistory cmdlet to find synchronization results.

Get-PSWSUSSyncHistory

Alternatively, you can find this list in the WSUS console.¹

WSUS service events

Check for WSUS events in the Application log under the Windows Server Update Services provider.

Get-WinEvent -FilterHashtable @{Logname='Application'; Providername='Windows Server Update Services'}

Especially have a closer look at events with ID 364.

Get-WinEvent -FilterHashtable @{Logname='Application'; Providername='Windows Server Update Services';ID=364} -MaxEvents 10 |Format-List

WSUS detailed log file

This one is very verbose and difficult to read.
But here is the path:
C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log

You may want to use the Select-String cmdlet to display only lines containing error, warning or fatal words.

Select-String -Pattern 'error|warning|fatal' -Path 'C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log'

Possible resolution steps

1. Restart the BITS service (used to download updates)

   Restart-Service -Name BITS
   

2. Restart the WSUS service

   Restart-Service -Name WsusService
   

3. If during your investigations with the steps described above you found in the event log some messages about updates which cannot be downloaded:
   1. Get the KB number from the URL
   2. Decline the KB in WSUS.For example, to decline KB819639 with cmdlets from the PoshWSUS module:

      Get-PSWSUSUpdate -Update 819639 |Deny-PSWSUSUpdate
      

      Alternatively you can use the WSUS console.³

   3. Start at WSUS cleanup

      Start-PSWSUSCleanup -DeclineSupersededUpdates -DeclineExpiredUpdates -CleanupObsoleteUpdates -CleanupUnneededContentFiles
      

      Alternatively, you can start the cleanup from the WSUS console.⁴

4. If you installed and imported the PoshWSUS module like explained above, you can use the Start-PSWSUSSync cmdlet to make WSUS synchronizing with the Microsoft database.

   Start-PSWSUSSync
   

   Alternatively, you can start the synchronization in the WSUS console.²

5. Wait a few minutes, go back to the beginning of this article and check your logs and events again.
6. If everything is working fine again and you need updates you declined at step 3, you can approve them again now.

   Get-PSWSUSUpdate -Update 819639 |Approve-PSWSUSUpdate -Action Install -Group WSUSGroupName
   

   Alternatively, you can use the WSUS console.⁵