On one of my Virtualmin hosting VMs I just found these entries in the auth.log, recurring every 8 minutes:
Oct 7 06:42:10 orion webmin: Timeout of session for
Nothing is given after the "for". There's nothing suspicious at the time in miniserv.log or Webmin's debug.log. Any idea where those entries might come from? My first idea was a break-in attempt, but the entries occur too regularly for that.