Hi,
in Audit Log you see only the changes made from the NSM GUI client.
If the changes has been made directly on the device (via WebUI or CLI) then you won't see them on the Audit Log, but still you can check the Log Viewer under "predefined-> 7-config" to see who logged into the device and save the config.
Hope this helps
Daniele