i want to know where the gateway save(location) syslog file before send it to another device
Perhaps the log you're thinking of is /var/log/messages? Or perhaps the access.log under Troubleshooting > Log Files > User-Defined-Logs > access.log (/opt/mwg/log/user-defined-logs/access.log/)
Though if you have things configured as described in the syslog best practice, you wont see messages in /var/log/messages, and the format may vary depending on who is consuming the syslog messages.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center