Just some hints. I wrote a few helper functions for similar purposes.

MaskToPattern(mask,sw) ; mask with * and ? -> M pattern
 ; $$MaskToPattern^Idea.System.ZIF("ABC?D*") -> 1"ABC"1E1"D".E
 ; sw .. used for contains test (.E on both ends) : $$MaskToPattern^Idea.System.ZIF("ABC?D",1) -> .E1"ABC"1E1"D".E

and

MATCH(input,mask) ; matches input string against search mask

-> $$MATCH^Idea.System.ZIF("CSVZ","CST*")=0, $$MATCH^Idea.System.ZIF("CSVZ","CSV*")=1
MATCHOR(input,masklist) ; matches input string against list of search masks with OR condition (at least one)

-> $$MATCH^Idea.System.ZIF("CSVZ","CSV*,PF*")=1
MATCHAND(input,masklist) ; matches input string against list of search masks with AND condition (all must fit)

-> $$MATCH^Idea.System.ZIF("CSVZ","CSV*,PF*")=0

My implementation :

 MaskToPattern(mask,sw) N pattern,char,pos S pattern="",char="" F pos=1:1:$L(mask) D
 . I $E(mask,pos)="*" S pattern=pattern_$S(char="":"",1:"1"""_char_"""")_".E",char="" Q
 . I $E(mask,pos)="?" S pattern=pattern_$S(char="":"",1:"1"""_char_"""")_"1E",char="" Q
 . S char=char_$E(mask,pos)
 S pattern=pattern_$S(char="":"",1:"1"""_char_""""),char="" S:$G(sw) pattern=".E"_pattern_".E"
 Q pattern

MATCH(input,mask) Q input?@$$MaskToPattern^Idea.System.ZIF(mask)
MATCHOR(input,list) N ok,pie,mask S ok=0 F pie=1:1:$L(list,",") S mask=$P(list,",",pie) I mask'="",$$MATCH^Idea.System.ZIF(input,mask) S ok=1 Q
 Q ok
MATCHAND(input,list) N ok,pie,mask S ok=1 F pie=1:1:$L(list,",") S mask=$P(list,",",pie) I mask'="",'$$MATCH^Idea.System.ZIF(input,mask) S ok=0 Q
 Q ok

Hi Alexey,

- yes, exacly, we scan the queue during backup node  startup

- the code is separated and ready to be delayed/called manually later (but, we never had to do this, except while testing)

- we never had timing issue and did not worry about this, whether it takes few seconds or few minutes

- in fact all this process has quite a few substeps

  a) scan all changed "roles" and update them (together with updating necessary resources)

  b) scan all changed "users" and update them (together with updating necessary resources)

  c) update also changed passwords (ssh, hush, little bit tricky/dirty)

  d) sending notifying e-mail to administrators/monitoring SW, that "D/R scenario happened and this XY instance on that XY machine is up"

Pavel