Hi,
I do not see screenshot of IBM's settings. Did you make sure that it is setup to send the logs to the SEM appliance? Something has to be done on the IBM side first or we will not receive the logs.
Do you see the ip address of the device in any of the logs that you had a screenshot of?
Have you asked IBM where it sends the logs? auth.log was probably what a customer that requested it sent in. Perhaps IBM is sending it to one of the other logs .
You could contact support if the above does not help to find a wireshark of whether the logs are even reaching the SEM appliance.