SQL2000 SP4 (SQL and Windows authentication) on Win2000SP4. Event ID 17055 (18456: Login failed for user 'sa'.) is being logged at an average of 20 times an hour. Tried to run SQL Profiler but it no trace information on the source (host, ip or application) of the failed login. Some forums suggest to unplug the server from network to know if its a local or networked issue but this is not possible in my case. Acquiring firewall/router logs from Network team is a headache. Any help on pinpointing what/where is this failed login coming from is very much appreciated.
