The combination of fast online anomaly detection and offline learning is a vital element of operations in large-scale datacenters and utility clouds. Given ever-increasing datacenter sizes coupled with the complexities of systems software, applications, and workload patterns, such anomaly detection must operate continuous and real-time at runtime. Further, detection should function for both hardware and software levels of abstraction, and for the multiple metrics used in cloud computing systems. In this paper, we present a novel, flexible framework to do anomaly detection for data center. The goal of our framework design is to combine online anomaly detection and offline learning automatically and iteratively. And the framework aims to have the capability to integrate different offline learning methodologies. We demonstrate this framework with two representative applications in datacenters, and explore three common scenarios during the applications runtime. Experiment results show that the proposed approach provides good accuracy and low overhead.