Is my SQLserver under attack?

[MaxZak]

Every night (at 3:00 AM) my SQL Server Log reports the message "Login failed for user 'sa'".
At that time I've no Windows' scheduled tasks and no active Jobs (the previous job starts ad 1:30 and ends at 1:45, the next one starts at 4)

I've assumed to be under an attack, but the event is too deterministic (every day at 3).
I've a secure 'sa' password, but I'd like to know if there's someone or something that's trying to violate my SQL server. I think that's a client on my netword because the firewall close the port 1433.
How can I know something more about that strange event?

Tanks

 

[ColinM]

You can use SQL Profiler to track logins & hosts. That should give you the computer name if it is on your network