Could you send me a PM or email me gweebo at gmail dot com.If you get stuck, I am happy to help out on the phone.
No Routing protocols.Are you using any routing protocols (bgp, rip, ospf, etc)?
What does memory usage look like, it is also climbing ?
That would greatly help yes !Mikrotik sends out the logs in syslog format, SARG needs to read in squid log format, hence the ugly and unreliable result.
It would be wonderful if Mikrotik folks could change that!
That's what I normally do, but in this case I don't want deploy a netflow collector at this location.maybe you should use traffic flow for this:
http://www.mikrotik.com/docs/ros/2.9/ip/traffic-flow