Updated logcheck webmin rules are attached. Regards, ogi
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ webmin\[[0-9]+\]: Successful login as ([[:alnum:].-]+) from .*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ webmin\[[0-9]+\]: Logout by ([[:alnum:].-]+) from .*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ webmin\[[0-9]+\]: Timeout of ([[:alnum:].-]+)[[:space:]]*$