Can you provide the log messages that these rules match?
A grep result of auth.log is attached.
There is one more possible message, but I think it's not for logcheck:
Dec 22 22:57:24 dwyn webmin[18988]: Invalid login as ogi from localhost.localdomain
Regards, ogi
Jan 23 16:59:25 dwyn webmin[1653]: Successful login as ogi from localhost.localdomain Jan 23 17:01:52 dwyn webmin[1743]: Logout by ogi from localhost.localdomain Jan 25 19:50:23 dwyn webmin[16302]: Successful login as ogi from localhost.localdomain Jan 27 11:33:40 dwyn webmin[21395]: Successful login as larry from localhost.localdomain Jan 27 17:17:58 dwyn webmin[24952]: Timeout of ogi Jan 28 10:22:49 dwyn webmin[24952]: Timeout of ogi
