Audit against live: Data is collected from the "master" server each time you execute the job. It will query the attributes of each object on the master via the agent and then use that to compare it against each target. This is slower because you have to re-query the contents of the master each time you execute the audit job.
Audit against snapshot: Data is collected from the snapshot master which lives in the database, and then compared against each target. This operation will be much faster as you are querying direct from the DB to each target.
I am not sure if I understood it well.
Live audit means that it scans master, stores information in DB or some cache and than is this temporary image used to compare target or each agent scans master and compares it to itself?
I mean if the master changes every time and so I have to do snapshot every time to get the information, is better to do snapshot or live audit?
Live audit means that it scans the master and stores that info temporarily in the DB / some cache to compare against all the targets (from what I understand).
If the master changes every time, then you will want to use a live audit. An audit based off a snapshot will be faster, but if your master is changing every time it may make more sense to keep it as a live audit instead of re-taking a snapshot each time, and then going into the audit job to change the master to the new snapshot.
Snapshots are best when your master is unchanging.