Are you saying Snort is not working, or are you just fretting about the change in displayed free memory? If Snort is working, I would say don't worry about the free memory. There could be several reasons for that not related to Snort. While Snort is live reloading rules (for example, after a nightly rule update) it will possibly use up to twice as much memory as normal since it temporarily holds two complete copies of the configuration in memory (including rules). It then switches the running Snort process over to use the newly built second in-memory configuration and then destroys the old configuration. That will account for some of the memory decrease.
Bill