The webmin log contains the correct caller ip like
webmin.log:195.xxx.xxx.216 - root [27/Feb/2013:10:40:43 +0100] "POST /session_login.cgi HTTP/1.1" 302 0
but the syslog bring the local ip in the log entry instead of the caller:
messages: Feb 27 10:40:43 dmbsrv webmin[6489]: Successful login as root from 192.168.1.1
The entry must be "as root from 195.xxx.xxx.216"!
Best regards
Dirk
Thanks for pointing this out - I will fix this in the next Webmin release.