The logon failures in SQL Server are logged in the Error Log as Error: 18456, Severity: 14, State: xx. The description of State are as below.
2 and 5:
Invalid Used ID. This happens when the user tries to logon with an ID that does not exist in the SQL Server instance.
This is the case when an attempt to use a windows login name with SQL Authentication.
Login disabled and password mismatch
11 and 12:
A valid domain account tries to access SQL Server where it is not explicitly added.
SQL Server service paused
The default database is not accessible (removed, suspect, offline)
Change password required. When “User Must change password on first logon” is specified when a login is created.
Someone tries to logon when the SQL Server is shutting down simultaneously.
When a Default Database is not specified for a login
A login does not have access to the Default Database.
I will update this post with more Error States as and when I find them.