Create a trace (or look in the default trace) for security events. I can't remember offhand which event it is, Books Online will have details.
p.s. Why are you using the sa login? That login should be disabled.
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)SQL In The Wild
: Discussions on DB performance with occasional diversions into recoverability
We walk in the dark places no others will enter
We stand on the bridge and no one may pass