Did you check to see if it is being killed off by OOMkiller??? We see that bro gets killed off by OOM killer periodically (I think we might have similar traffic profiles), but that should just kill off a worker or two, not the entire process. Check for that in /var/log/messages.
Bro once invoked oom killer but that was on 11th Oct, no records recently 
Oct 11 18:33:21 bro-Sensor kernel: bro invoked oom-killer: gfp_mask=0x200da, order=0, oom_score_adj=0
Oct 11 18:33:21 bro-Sensor kernel: [] oom_kill_process+0x24e/0x3b0
Thanks for the comments!