A log file contains operation records, each operation record is of a certain type, and each operation record is associated with a transaction. A plurality of operation records is read from the log file into a record store. Records of the plurality of operation records of each operation record type are sampled at a predefined sampling rate. Operation records in the plurality of operations records are identified that are associated with completed transactions of which the sampled operation records are associated. The identified operation records are then extracted from the record store into a data store.