Unix/Linux systems maintain a database of currently logged-in users, in the
/var/run/utmp file (in some Unix variants there's also a parallel
utmpx file, but they both serve the same purpose). The
login program, which controls login on a physical console, the ssh daemon or GUI login programs for machines with X servers update information in that file when user logs in or out.
who command reads information from that database.
The shell you start with
su - is a "login" shell in sense that it behaves in the same way as the login shell started by the
login program or ssh daemon (executes the same initialization files, etc.) but it does not record logins in
utmp file, therefore you don't see these shells in the output of
On the other hand, if you eg. start a
screen records an entry in the
utmp file and you can see the session in the output of
Also, in some graphical DEs each new terminal window that you open is considered a new login and recorded in
utmp, and in another ones not - there is only one main entry in
utmp for the user being logged to the whole DE session. It depends on the terminal application of course.