diff --git a/bpf.h b/bpf.h
index cfa6d3e..59462a2 100644
--- a/bpf.h
+++ b/bpf.h
@@ -67,6 +67,30 @@
 # define EM_ARM 40
 # endif
 #define ARCH_NR	AUDIT_ARCH_ARM
+#elif defined(__hppa__)
+#define ARCH_NR AUDIT_ARCH_PARISC
+#elif defined(__ia64__)
+#define ARCH_NR AUDIT_ARCH_IA64
+#elif defined(__mips__)
+# if defined(__MIPSEB__)
+#define ARCH_NR AUDIT_ARCH_MIPS64
+# else
+#define ARCH_NR AUDIT_ARCH_MIPSEL64
+# endif
+#elif defined(__powerpc64__)
+#define ARCH_NR AUDIT_ARCH_PPC64
+#elif defined(__powerpc__)
+#define ARCH_NR AUDIT_ARCH_PPC
+#elif defined(__s390x__)
+#define ARCH_NR AUDIT_ARCH_S390X
+#elif defined(__s390__)
+#define ARCH_NR AUDIT_ARCH_S390
+#elif defined(__sparc__)
+# if defined(__arch64__)
+#define AUDIT_ARCH_SPARC64
+# else
+#define AUDIT_ARCH_SPARC
+# endif
 #else
 #error "AUDIT_ARCH value unavailable"
 #endif
diff --git a/util.c b/util.c
index 0923ef9..3d5a3c2 100644
--- a/util.c
+++ b/util.c
@@ -10,12 +10,28 @@
 
 #include "libsyscalls.h"
 
+/*
+ * These are syscalls used by the syslog() C library call.  You can find them
+ * by running a simple test program.  See below for x86_64 behavior:
+ * $ cat test.c
+ * main() { syslog(0, "foo"); }
+ * $ gcc test.c -static
+ * $ strace ./a.out
+ * ...
+ * socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 <- look for socket connection
+ * connect(...)                                    <- important
+ * sendto(...)                                     <- important
+ * exit_group(0)                                   <- finish!
+ */
 #if defined(__x86_64__)
 const char *log_syscalls[] = { "connect", "sendto" };
 #elif defined(__i386__)
 const char *log_syscalls[] = { "socketcall", "time" };
 #elif defined(__arm__)
 const char *log_syscalls[] = { "connect", "gettimeofday", "send" };
+#elif defined(__powerpc__) || defined(__ia64__) || defined(__hppa__) || \
+      defined(__sparc__)
+const char *log_syscalls[] = { "connect", "send" };
 #else
 #error "Unsupported platform"
 #endif