The dynamic fluctuation of workload influences system metrics, affects the precision of anomalydetection. This paper proposes an online anomaly detection approach for Web applications, which handles workloadfluctuation in both request pattern and volume. The study proposes an incremental clustering algorithm to recognizeonline workload patterns automatically. For a specific workload pattern, the study adopts local outlier factor todetect anomaly and qualify the anomaly degree, and then locate the abnormal metrics with a student’s t-test method.The experimental results show that the clustering algorithm can accurately capture workload fluctuations in atypical Web application, and demonstrate that the approach is capable of not only detecting the typical faults in Webapplications, but also locating the abnormal metrics.