diff --git a/CHANGELOG.md b/CHANGELOG.md
index a434d6f..001e93c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
+- Fixed syscall lookup for ppc64 and ppc64le. [#71](https://github.com/elastic/go-libaudit/pull/71)
+
 ### Removed
 
 ### Deprecated
diff --git a/auparse/mk_audit_syscalls.pl b/auparse/mk_audit_syscalls.pl
index 329d75c..ede0c8f 100644
--- a/auparse/mk_audit_syscalls.pl
+++ b/auparse/mk_audit_syscalls.pl
@@ -100,4 +100,14 @@ package auparse
 print <<EOF;
 }
 
+func init() {
+	// Add "aliases" to ppc for ppc64 and ppc64le. They share the same tables.
+	ppcTable, found := AuditSyscalls["ppc"]
+	if !found {
+		panic("missing ppc syscall table")
+	}
+	AuditSyscalls["ppc64"] = ppcTable
+	AuditSyscalls["ppc64le"] = ppcTable
+}
+
 EOF
diff --git a/auparse/zaudit_arches.go b/auparse/zaudit_arches.go
index dc58a62..400985f 100644
--- a/auparse/zaudit_arches.go
+++ b/auparse/zaudit_arches.go
@@ -15,7 +15,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
-// Code generated by go tool cgo -godefs - DO NOT EDIT.
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
 // cgo -godefs defs_audit_arches.go
 
 package auparse
diff --git a/auparse/zaudit_syscalls.go b/auparse/zaudit_syscalls.go
index 5a36d60..80d4b05 100644
--- a/auparse/zaudit_syscalls.go
+++ b/auparse/zaudit_syscalls.go
@@ -2737,3 +2737,13 @@ var AuditSyscalls = map[string]map[int]string{
 		332: "statx",
 	},
 }
+
+func init() {
+	// Add "aliases" to ppc for ppc64 and ppc64le. They share the same tables.
+	ppcTable, found := AuditSyscalls["ppc"]
+	if !found {
+		panic("missing ppc syscall table")
+	}
+	AuditSyscalls["ppc64"] = ppcTable
+	AuditSyscalls["ppc64le"] = ppcTable
+}
diff --git a/rule/rule_test.go b/rule/rule_test.go
index 5496868..7b61b63 100644
--- a/rule/rule_test.go
+++ b/rule/rule_test.go
@@ -133,6 +133,19 @@ func TestAddSyscall(t *testing.T) {
 			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
 		}
 	})
+
+	t.Run("open", func(t *testing.T) {
+		rule := &ruleData{
+			arch: "ppc64le",
+		}
+		if err := addSyscall(rule, "open"); err != nil {
+			t.Fatal(err)
+		}
+		if assert.Len(t, rule.syscalls, 1) {
+			const openSyscallNum = 5
+			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
+		}
+	})
 }
 
 func TestAddFilter(t *testing.T) {
@@ -335,6 +348,16 @@ func TestAddFilter(t *testing.T) {
 		assert.EqualValues(t, auparse.AUDIT_ARCH_X86_64, rule.values[0])
 	})
 
+	t.Run("arch_ppc64le", func(t *testing.T) {
+		rule := &ruleData{}
+		if err := addFilter(rule, "arch", "=", "ppc64le"); err != nil {
+			t.Fatalf("%+v", err)
+		}
+		assert.EqualValues(t, archField, rule.fields[0])
+		assert.EqualValues(t, equalOperator, rule.fieldFlags[0])
+		assert.EqualValues(t, auparse.AUDIT_ARCH_PPC64LE, rule.values[0])
+	})
+
 	t.Run("perm", func(t *testing.T) {
 		rule := &ruleData{flags: exitFilter}
 		if err := addFilter(rule, "perm", "=", "wa"); err != nil {