Essentially every 24-25 hours or whenever a host requests an update.
From the CSA 6 MC help file:
How Signatures are Updated
For signature-based AntiVirus protection, the CSA MC maintains a cached version of the Clam AntiVirus signature files and acts as a proxy server when a signature update is requested by an agent.
Agent requests for signature file updates trigger the CSA MC to obtain and provide virus definitions. When agents request updated virus signature files from the CSA MC, the CSA MC compares the time-stamp of the signature files on the Clam AntiVirus server with its cached version of the file. If the time-stamp of the files on the Clam AntiVirus server matches the copy of the signature files cached on the CSA MC, the CSA MC provides the agent with the signature updates from its own cache. If the CSA MC's cached version is out of date, the CSA MC passes the agent's request directly to the Clam AntiVirus server and then caches the new version of the signature files when they are returned.
An agent contacts the CSA MC for signature updates as a result of one of these events:
A scheduled request for antivirus updates. An agent contacts the CSA MC every 24 - 25 hours for updated virus definitions.
Forced antivirus updates from a host. Users can force an antivirus update from the AntiVirus screen of Cisco Security Agent interface.
Forced antivirus update for a group. CSA MC administrators can force an antivirus update for a group from the group's properties page.
Tom