  SWIM is a peer-to-peer group membership protocol with attractive scaling and
robustness properties. However, slow message processing can cause SWIM to mark
healthy members as failed (so called false positive failure detection), despite
inclusion of a mechanism to avoid this.
  We identify the properties of SWIM that lead to the problem, and propose
Lifeguard, a set of extensions to SWIM which consider that the local failure
detector module may be at fault, via the concept of local health. We evaluate
this approach in a precisely controlled environment and validate it in a
real-world scenario, showing that it drastically reduces the rate of false
positives. The false positive rate and detection time for true failures can be
reduced simultaneously, compared to the baseline levels of SWIM.
