I have had trouble before when running the demo appliance where it thinks the license is already expires so it won't let me add nodes. I had to contact support to resole if I recall correctly; this was a while back.
If you go to the CLI menu console on the appliance under the appliance menu you can actually check the raw syslogs by running "checklogs". From there you can specify the different logs you want to look at to verify that LEM is actually receiving the logs.
Once you have verified that LEM is actually receiving the logs then you need to verify if the connector will actually capture the logs that you have.
Hope this helps!