diff --git a/tcpdump.spec b/tcpdump.spec
index 0b4ef1e..e2897fc 100644
--- a/tcpdump.spec
+++ b/tcpdump.spec
@@ -2,7 +2,7 @@ Summary: A network traffic monitoring tool
 Name: tcpdump
 Epoch: 14
 Version: 4.9.2
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: BSD with advertising
 URL: http://www.tcpdump.org
 Requires(pre): shadow-utils
@@ -72,8 +72,10 @@ sed -i 's/\(\.TH[a-zA-Z ]*\)[1-9]\(.*\)/\18\2/' \
 	${RPM_BUILD_ROOT}%{_mandir}/man8/*
 
 %pre
-/usr/sbin/groupadd -g 72 tcpdump 2> /dev/null
-/usr/sbin/useradd -u 72 -g 72 -s /sbin/nologin -M -r \
+/usr/bin/getent group tcpdump >/dev/null || /usr/sbin/groupadd \
+	-g 72 tcpdump 2> /dev/null
+/usr/bin/getent passwd tcpdump >/dev/null || /usr/sbin/useradd \
+	-u 72 -g 72 -s /sbin/nologin -M -r \
 	-d / tcpdump 2> /dev/null
 exit 0
 
@@ -86,6 +88,9 @@ exit 0
 %{_mandir}/man8/tcpdump.8*
 
 %changelog
+* Mon Sep 16 2019 Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-9
+- Adding getent to pre scriptlet to avoid audit messages (rhbz#1715420)
+
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 14:4.9.2-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild