We propose a performance anomaly clustering method for determining suspicious components in web applications. Our clustering method clusters observed anomalies based on their root causes. The key insight behind our method is that the measurements of anomalies that are negatively affected by the same root cause deviates similarly from standard measurements. The results of case studies, which were conducted using RUBiS , an auction prototype modeled after eBay.com , are encouraging. From the clustering results, we searched for the components exclusively used by each cluster and successfully determined suspicious components such as server processes, Enterprise Beans, and methods in an Enterprise Bean.