First thing you should do is upgrade to the latest version of E4 code in your train (6.0, 6.0, 7.1 etc). Some of the older vsrions of code had a memory leak under certain conditions.
The second thing is to determine if this is being caused by traffic (in which case there is little you can do about it beside swapping in a larger sensor or changing your existing signature policy/actions). If you have three sensors have the same signature poilcy on them you can swap two of the and see if the problem follows the sensor of the traffic (my bet is it follows the traffic)
Lastly you should determine if this is really a problem (maybe this should be first). Are you seeing any missed packet percentages in yoru log?
- Bob