Hello @murmucka ,
NBAR flow chache restarts after router reload.
You should look for Netflow, flexible netflow that is thought to provide flow accounting and allows to export flow accounting data to a Netflow collector server over an UDP port.
At that point you can get traffic baselines on the collector server.
NBAR as far as I know has been introduced to solve the issue to make the router / device capable to recognize applications using dynamic TCP or UDP ports for the purpose of correct classification within the modular QoS framework but it does not have export capability of its flow based data.
Netflow that had been introduced before NBAR is an accounting feauture per flow that at the beginning could work only on inbound packets now it can be applied inbound, outbound or both.
Multiple devices can export their netflow data to same netflow collector.
For redundancy support for two collectors have been introduced at least in high end platforms.
Hope to help
Giuseppe
