2 most likely reasons
- logs from these devices are not hitting the syslog server on LEM (ie, something blocking syslog traffic). The eval guide has a section on how to verify using the checklogs command
- the logs are hitting the syslog server but the relevant connectors are not enabled. See the manual method for enabling connectors in the eval guide