So if the SA account isn't disabled, I want to know when there's an SA login failure.
[Generally, I want to know when there's an SA login success, as well, but we'll focus on the failures, here, because it's really low-hanging fruit.]
SQL Server AlertsSQL Server Alerts are a very light-weight notification tool for lots of SQL Server events. Brent Ozar has a nice run-down of some basic alerts that you ought to consider implementing; we'll add this one as another.
It's possible--and frequent--to address this problem by using login triggers. That is certainly a valid, functional, and well-worn method. Login triggers can introduce problems, though, especially when we have forgotten that they exist. Moreover, this is what alerts are for, and there's something appealing to the simplicity of it all.