ZENworks audit events are of two types:
Change Events: These events capture configuration changes made to the zone through ZENworks Control Center or the zman command line utilities. You can capture a variety of changes ranging from bundle changes to ZENworks system changes. For example, you can configure an audit event that records the activity of an administrator assigning a bundle to a device.
Agent Events These events capture actions that occur on the ZENworks managed devices. They are also called Device events.
Both change events and agent events can be enabled for all devices in the zone or for individual devices.