SA Login 
SA Login authentication failures, essentially, should never happen. Mostly that's because we generally shouldn't be using the SA account, but rather should have dedicated application logins with appropriate privileges. Having those logins use Windows authentication instead of SQL authentication further removes SQL Server from the authentication process, which is even better.
So if the SA account isn't disabled, I want to know when there's an SA login failure.
[Generally, I want to know when there's an SA login success, as well, but we'll focus on the failures, here, because it's really low-hanging fruit.]
SQL Server Alerts
SQL Server Alerts are a very light-weight notification tool for lots of SQL Server events. Brent Ozar has a nice run-down of some basic alerts that you ought to consider implementing; we'll add this one as another.It's possible--and frequent--to address this problem by using login triggers. That is certainly a valid, functional, and well-worn method. Login triggers can introduce problems, though, especially when we have forgotten that they exist. Moreover, this is what alerts are for, and there's something appealing to the simplicity of it all.
