diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
index 70997e01..b1df45dc 100644
--- a/config/filter.d/webmin-auth.conf
+++ b/config/filter.d/webmin-auth.conf
@@ -18,8 +18,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = webmin.* Non-existent login as .+ from <HOST>$
-            webmin.* Invalid login as .+ from <HOST>$
+failregex = webmin.* Non-existent login as .+ from <HOST>\s*$
+            webmin.* Invalid login as .+ from <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/Webmin
new file mode 100644
index 00000000..86d3f321
--- /dev/null
+++ b/testcases/files/logs/Webmin
@@ -0,0 +1,7 @@
+#Webmin authentication failures from /var/log/auth.log
+
+#1 User exists, bad password
+Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230 
+
+#2 User does not exists
+Dec 12 23:14:19 sb1 webmin[22134]: Non-existent login as robert from 188.40.105.142