it's difficult to monitor snort because it doesn't write a pidfile by default, this changes are needed:

• add a snort.conf for tmpfiles with the contents:

  `d /run/snort 0750 snort snort - -`

• add `--pid-path /run/snort --create-pidfile` to snort@.service