diff --git a/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c b/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c
index 38183605a2..07c9a8fd1b 100644
--- a/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c
+++ b/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c
@@ -65,10 +65,6 @@ SEC("cgroup/sysctl")
 int sysctl_monitor(struct bpf_sysctl *ctx) {
         int r;
 
-        /* Ignore events generated by us */
-        if (bpf_current_task_under_cgroup(&cgroup_map, 0))
-                return 1;
-
         /* Allow reads */
         if (!ctx->write)
                 return 1;
@@ -89,6 +85,14 @@ int sysctl_monitor(struct bpf_sysctl *ctx) {
         we.pid = bpf_get_current_pid_tgid() >> 32;
         we.cgroup_id = bpf_get_current_cgroup_id();
 
+        r = bpf_current_task_under_cgroup(&cgroup_map, 0);
+        if (r < 0) {
+                we.errorcode = r;
+                goto send_event;
+        }
+        if (r == 1)
+                return 1; /* Ignore events generated by us */
+
         /* Only monitor /proc/sys/net/ */
         r = bpf_sysctl_get_name(ctx, we.path, sizeof(we.path), 0);
         if (r < 0) {