If you have the switches sending syslog to your Orion server you can simple create a syslog alert for the Syslog Message Pattern *err-disable* (note the asterisk at the start and end of the message).
You should also probably configure auto recovery on your switches by entering the following commands in config mode
errdisable recovery cause udlderrdisable recovery cause bpduguarderrdisable recovery cause security-violationerrdisable recovery cause channel-misconfigerrdisable recovery cause pagp-flaperrdisable recovery cause dtp-flaperrdisable recovery cause link-flaperrdisable recovery cause gbic-invaliderrdisable recovery cause l2ptguarderrdisable recovery cause psecure-violationerrdisable recovery cause dhcp-rate-limiterrdisable recovery cause vmpserrdisable recovery cause storm-controlerrdisable recovery cause arp-inspectionerrdisable recovery cause loopback
You can also control how quickly auto recovery will recovery from an errored interface with the following command
errdisable recovery interval 600
I try this, thank you for your time.
