Adding some info for historical reference...
  Bug 710172 - [RFE] Provide automated healing of expiring subscriptions
  Bug 726411 - [RFE] Support for certificate healing
  ^^^
  These are the two RFE bugs from the pm Mike Khusid that introduced the desire for default auto healing

  Bug 976867 - subscription-manager autoheal needs feedback and a review of options
  ^^^
  This is the bug where the term auto-heal was replaced by auto-attach after a review with UXD Matt Reid.

Currently the auto-attach preference is enabled by default which means that when the rhsmcertd runs (defaults to once every 4 hours - see autoAttachInterval=1440) the candlepin server will check the installed products to see that they are fully Subscribed.  If the system is not fully covered by valid subscriptions, then candlepin will do it's best with the subscriptions available to satisfy coverage of the installed products in need of coverage.  If multiple subscriptions are available (e.g. Subscription A provides coverage for product X and Y, and Subscription B provides coverage for X, while the system only needs additional coverage for product X), it is possible that candlepin will grant an entitlement from the heavier subscription (Subscription A which provides for product X (which is needed) and product Y (which is effectively wasted).   Maybe this is what is being observed in the problem description.


Some more info is need to understand exactly what is happing in the following two statements from the problem description.  As written, something feels wrong because the "auto-attach" feature will not consume a subscription unless it provides coverage for at least one installed product.  I have a feeling that your only available subscription provides content for both RHEL and Satellite and your RHEL system is auto-attaching to it.

> This can be an issue due to customers with virutal data center licenses because when a random system because unsubscribed it will "auto-attach" itself to any subscription, including ones that will not work on the system.

> This also hurts because random systems will "auto-heal" and steal any subscription available ie Satellite subscription.

Please show a list --available so we can seen exactly what is provided by your virutal data center subscription.

Regardless of comment 3, it sounds like this RFE is to effectively issue an automatic call to "subscription-manager auto-attach --disable" whenever a call is made to "subscription-manager attach --pool=<POOLID>"

IMHO, this request will cause future problems down the road when the subscription expires leaving the system with installed products that are not covered by a valid subscription.

However if the user consciously wants to turn off the healing daemon, then they can manually call "subscription-manager auto-attach --disable".

I'm curious what the developers think.

Just a side note "auto-heal" is causing 


example..

customer has 50 systems registered in the customer portal RHSM. 

They all become registered but not subscribed, within minutes they begin to grab subscriptions.

Customer is now on the phone with us.. 

Our phone specialists are trying to help through c-service to detach subscriptions, so that the customer can add the correct subscription to the correct system.

"RHEL for virtual datacenters"

As soon as the customer or RH was detaching the subscription from a host, it would immediately come back.. They then had to disable autoattach on all the registered but not subscribed systems to force them to stop, so they could att the RHEL for virtual datacenter onto the hypervisor.

I'm not saying with should end auto-heal.. it is good in some situations. I'm more so saying, virtual systems shouldn't "eat" or auto-heal themselves with PHYSICAL entitlements. They can heal all day with normal subs, but they are healing with subs that specifically go on very specific systems ( satellite, capsule, vdc, rhel for unlimited guests) ect.

I'll respond to the need info stuff soon. I just happen to catch this situation yesterday.

Closed in favor of RFEs referenced in Comment 8

@Barnaby and @John ... how are the two RFE's mentioned addressing the obvious issues with auto-attach referenced in Comment 1 and Comment 7 ?  I am not sure this bug should be closed.  It seems to me that 'auto-attach' is, many times, grabbing incorrect subscriptions that cause the customers to have to painfully - manually correct things.

With expiring subscriptions, rhsm should easily be able find a matching subscription to 'auto-heal'.

closing this in favor of 
https://bugzilla.redhat.com/show_bug.cgi?id=1400655