Anomalies in web servers caused by intentional or unintentional acts, such as hacker attacks and misconfliguration, can severely damage the system. There is no obvious indicator that differentiates between normal and abnormal behaviors. In this paper, principle component analysis (PCA) is used to transform the measurable features into dimensions according to their variances. Ten features were selected and interpreted from the error log and access log of an Apache web server. To detect web anomalies, we identify sudden peaks on six PCA dimensions with the highest variances. We experiment with four types of web anomalies: broken link, password cracking, script error, and directory scan, on a real production web server. The results indicate that the PCA technique correctly detects web anomalies with an average detection hit rate of 0.81. with directory scan having the highest hit rate among all types of anomalies.