I have a Windows Server 2008 R2 box running IIS 7.0 and SQL 2008 R2. I have a Juniper firewall protecting my server but we do have port 80 open to the Internet because we require it. My IIS logs are pretty mild. I have a few script attempts here and there, but my SQL logs are flooded (1000+/day) with 'sa' logon attempts.
How is my SQL server getting hit without my IIS Server logging it?