How can I hunt down what is trying to use SA? I'm not sure of the change that caused this (the logs don't show anything specific) but ever since Monday afternoon I've seen the following error repeated:

Login failed for user 'sa'. Reason: An attempt to login using SQL authentication failed. Server is configured for Windows authentication only. [CLIENT: 10.10.220.32]


The IP reported is the SQL Server. Since this is ongoing, is there a way I could figure out what is trying to pass this credential? If I could get an application name or anything I could probably fix the problem.
To track login failure reason SQL Server Profiler would be a good option. One can also use extended events trace to capture login failed events and reason behind the failure.

You need to first launch SQL Server Profiler.Create a new template or you can use existing one if you have already. Please include below when creating the trace

1.Audit Login Failed (under Security Audit)
2.User Error Messages (under Errors &amp; Warnings)
3. Errorlog (under Errors &amp; Warnings)


Then clear the Show All Events tick box and select following columns

TextData
SPID
ClientProcessID
Hostname
LoginName
NTUserName
NTDomainName
ApplicationName
DatabaseName
Error


More details can be taken from This Link and This Link

To read more about SQL Server profiler refer to this Microsoft Online Doc