Main service (invoked by scheduler) – Enable auditing=When top-level service only. In your case the service is invoked by a scheduler and not by trigger or client request.
child service (which is invoked in the main service) – Enable auditing=Always
FYI:
When top-level
service only - Indicate that the service should generate audit
data only when it is invoked by a client request
or a trigger. The service does not generate audit
data when it is invoked by another service (that
is, when it is a nested service).
Always - Indicate that the service should generate audit
data every time it executes. Select this option if
the service is a critical service that you want to be
able to audit every time it executes.
For further clarifications, write me on email.