If a packet capture conducted on LMI confirms data from a particular log source is being received but the LMI GUI does not reflect the log source entry being created then you can use the guidance in this article to help troubleshoot that.

One possibility is that the user does not have permission to view the device. Log in as the admin user and verify the device exists. If it does then the user's log source permissions will need modified to view the device on the devices tab and on the log source status page.

Another possible issue could be the appliance exceeded the maximum number of devices. Most appliance models have a default maximum device count of 16,000. Logs in sys.log will indicate if this is the issue.

A third possibility is that "Auto Identify Log Sources" is not enabled, if this is not enabled no new devices will be automatically added to the system. This setting is on the Administration -> System Settings page on the General tab.

Lastly, if the log source was already sending other event data to the appliance and identified as a different device type then it's recommended to confirm that the newly received logs are not still being identified as that other device type and therefore being associated with the existing log source rather than with a newly created one.

This article helps troubleshoot why a log source entry isn't being created despite proof that events from the log source are being received.