Radu's answer is extremely informative herehttps://askubuntu.com/questions/376932/why-who-command-does-not-shows-root-as-a-logged-in-userHowever this makes me wonder what is the exact definition for  logging in in Linux?
What is the exact definition for logging in
login;pam
I don't know if you'll ever find a precise definition that everyone agrees on. Maybe just /bin/login or equivalent. Everyone should at least agree that su isn't a login though, since it doesn't replace the existing login on the terminal, and one of the defining features of a login is that only one person at a time is logged in on any one terminal.My definition, which will probably be contested, is that log in means to start a new session, on a terminal (or X display) that currently has nobody using it. But what about when you create a new terminal? Launching an xterm doesn't feel like logging in even though it creates a new tty, because it doesn't ask for authentication (you authenticated at the start of the X session, or earlier if you used startx.Starting a new ssh connection, on the other hand, is definitely very login-like, even when it's not configured to use /bin/login. Unless you specify a command to run on the remote instead of an interactive shell - an operation that requires authentication but doesn't feel like a login exactly.The original question you link to is easier to answer because it's about something concrete (the who command), instead of the philosophical question of what it means to log in. The precise answer is that who reports the contents of the utmp file. If you want to know whether a specific action (like su or xterm or ssh localhost -l root) will record an entry in utmp, the answer is often it depends. xterm has options -ut and +ut to control whether the terminal will be added to utmp.In screen, you can toggle the current tty's utmp entry with CtrlA followed by L. The L stands for login.For ssh, I don't see any dedicated option. After a few experiments, it seems that you get a utmp entry if you create a tty, even if you run a non-interactive command on it (ssh -t localhost w shows the w in its own listing).